Week 7 Assignment Ricardo Nevarez

Installing and setting up Oracle’s VirtualBox v. 5.2 are one of the many steps towards setting up

the virtualized lab environment for this course. The virtualized environment is set up on the

computer to create virtual machines to test in a secure way security threats and analyze these threats

that may occur on an actual production network. Within this environment I can test out malware,

viruses, Distributed Denial of Service (DDoS), and more, including testing and vetting security

tools for real world practical use. This is also an environment that open source visualization and

vulnerability tools can be set up and tested develop troubleshooting skills in a safe and controlled

environment.

The following was used to set up my virtualized test lab including the two (2) virtual machines

(VM’s) that included Kali Linux and CentOS. The opensource tool used within Kali Linux is

NMAP. This is a network port scanner security tool and is used to identify open ports at the target

machine.

Oracle VM VirtualBox release version 5.2.18

http://www.oracle.com/technetwork/server-storage/virtualbox/downloads/downloads-176856.html

Kali Linux release version kali-linux-2018.2-amd64

https://www.kali.org/downloads/

CentOS – 7 release version x86_64 vbox Everything – 1804

https://www.centos.org/download/

NMAP release version 7.70

https://nmap.org/download.html

Week One (1) Assignment – setting up a virtualized lab environment

The first assignment of this course was to set up the virtualized environment with a couple VM’s using

NMAP to scan the Metasploitable VM. The objective is to scan and identify open available ports on the

Metasploitable VM.

1|Page
Downloading and Installing the Kali Linux VM in the Oracle VM Virtual Box Manager

The download file size of Kali Linux is 2.8GB of which will take a little time depending on network

bandwidth. With my existing current download speeds of 22Mbps it takes approximately 20 minutes to

download the Kali Linux ISO. The file name is kali-linux-2018.2-amd64.

Once download on the local machine the ISO image needs to be set up within Oracle’s VirtualBox.

First within we start up the Oracle Virtual Box. Next open the Create Virtual Machine and assign the VM

a name. For this assignment I named it KaliLinux. The Type selected is Linux and Version Other Linux

(64).

Next, the RAM size for the VM is selected. I set the VM Ram to 4000MB = 4G.

Next, the VM Hard disk is set up to the recommended size of 8GB.

Week 7 Assignment Ricardo Nevarez

Next, is allocating a dynamic area on the hard disk to store the image.

Next, the File Location and Size is set to Kali Linux and 8GB respectively. I purposely misspelled

this.

The VM within Oracle is now configured and all that remains is select and mount to run the ISO.

3|Page
There are many options with running Kali Linux including the graphical user interface (GUI)

install. The available boot options include Kali include Live, Live (forensic mode), Live USB

persistence, Live USB Encrypted Persistence, Install, Graphical Install, Install with speech and

Advance options.

Regarding more specific setting during the install, the default options are selected including setting

the DHCP and IPv6 to autoconfigure. The hostname chosen is kaliboots, and this is the name that

systems identifies itself to the network.

Next, the Domain name is named boots.org. Root Administrator password is set to “password”

(not recommended). The default partition was selected and confirmed by clicking YES for this

install with the VM.

Installation failed at the step of the installation. Prompted to discontinue or reattempt the

installation. I reattempted the installed getting the same failed to install error. The installation step

of the process is what failed. I continued to go back to this process several times with the same
Week 7 Assignment Ricardo Nevarez

results. After some unsuccessful attempts I opted to restart the Kali VM installation from the

previous step Partition Disks. I continued to get the same failed to install error.

I sent the Shut Down signal to shut down the VM machine to restart the installation process from

the beginning. I attempted this several times with the same end result.

Not giving up, I chose to select the Live boot of Kali of which I now have the Kali system running.

Success!

Next, to log in to the Kali Linux requires entering the password created earlier, and the desktop

image below is of Kali Linux

5|Page
Next is to download, install and set up WebGoat from GitHub per the instructions of this

assignment. The current version as of this writing is WebGoat 8.0 with a jar filesize of 74.7MB.

WebGoat version 8.0 https://github.com/webgoat/webgoat/releasses

To install Webgoat 8.0 within Kali Linux will require using the command line interface (CLI). The

file to run is Java -jar webgoat-server-8.0.0.M21.jar. Next is to run the Metasploit exploitation tool

on the second VM with the correct network adapter settings.

In the process of downloading the CentOS ISO from a mirror site the computer crashed on me.

The zipped file size is 4.2 GB.

Challenges for this assignment.

Issues with completely completing this week 1 assignment was caused by a crashed computer and

the for some reason the File Explorer stopped working. I was able to go to the file, but File Explorer

would crash when trying to open any file. Attempted restore point, and some suggested repair steps

of which did not resolve my issue.

Week 7 Assignment Ricardo Nevarez

The remainder of this assignment required me to download the CentoOS and install that on a

second VM within the Oracle VM VirtualBox Manager and run both the Kali and the CentoOS

with the Metasploit application running. Next, I would be running NMAP to scan Metasploitable.

From the Kali VM I should be able to ping the Metasploit to access the web server and see any

available open ports.

Note that for one VM to communicate to another VM within the Oracle VM VirtualBox Manger,

the network adapter must be set to Bridged Adapter. Otherwise the Kali VM will not be able to

run NMAP on the Metasploitable VM. Without setting the Bridged Adapter, VM’s will not be able

to talk to each other. My intention is to rebuild my laptop, and reattempt with redownloading

everything including the Kali Linux ISO and make another attempt with successfully install and

running it. Using the available LIVE option loses all settings after the shutdown of the VM and

does not allow me to save any of my work.

Week Two (2) Assignment – Trade Study includes virtualized lab architecture

Step 1. The considered criteria set is to visualize network pattern differences between secure and

non-secure internet web browsing using the Firefox browser within the CentOS 7 operating

system. After many trials and errors, I was not able to get Gephi to properly run within CentOS 7

or KaliLinux.

Step 2. There are many available network visualization tools that allow to see in real-time and

within collected saved logs of what and where the targeted data is coming from and where it’s

going throughout the organizations network. Having this data to analyze and knowing how it

traverses throughout the network is clearly an asset of which allows to make informed decisions

of current traffic flow information within a time frame to effectively plan to implement a reroute

of traffic for better network traffic utilization.

7|Page
Two (2) of many available network visualization tools, I selected the Gephi running on the Linux

platform and Network Workbench. Gephi is an Application Programming Interface (API) used to

visualize the dynamic communications and events between nodes on the network. This is not

limited to communication of which includes email, video, but to anything traversing the network.

The collected information allows to make decisions that can allow us to see what the least cost

path of node communication over another is possible. This allows for a more efficient computer

network. This can be especially useful when analyzing the data among the departments and

managing VoIP communications among other data traveling over the network.

Gephi https://gephi.org/users/download/ . Network Workbench http://nwb.cns.iu.edu/download.html

Step 3. As mentioned earlier I identified and selected using Gephi the network security

visualization tool. Among its many features I like that it’s capable of handling large size

visualizations and a high number of network nodes.

Step 4. The Gephi download is available https://gephi.org/ . The current available downloadable

version for this assignment is Gephi 0.9.2. Once downloaded, the file was moved to the Downloads

folder. Java is also required to be installed. I used the known commands in CLI found here to

download and install java http://exweeto.com/News/ArtMID/459/ArticleID/38/Installing-

Updating-Java-on-Kali-Linux . Next remember to set Java as default. Use CLI to start the Gephi

application and its command is ./gephi from the Downloads folder.

Configuration to set up Gephi will include the installation of the HTTP plugin available through

Tools/ Plugins/ Available Plugins. Next go to File| Generate| HTTP Graph. Because it will be

visualizing HTTP traffic the Proxy listening is on port 8080. Next Manual Proxy has been set up

for the internet using localhost IP with port 8080.

Week 7 Assignment Ricardo Nevarez

Step 5. In an attempt to properly run Gephi I downloaded and installed Gephi for Windows version

0.9.2. Regardless of having the required Java to run Gephi, the program would not launch.

Regardless of executing the proper procedures Gephi running within Kalilinux would not record

the data between my two nodes within the virtual lab and while jumping from websites to websites

that were HTTPS and HTTP.

Week Three (3) Assignment includes virtualized lab architecture

Viewing Network Communications using Wireshark

This assignment requires working cybersecurity tool Wireshark on the network. This tool allows

us to look inside the computer network and what type of network traffic traverse it. Wireshark is

an open source packet analyzer that allows the IT professional to capture, decode to analyze

network traffic between network nodes. Detailed here is the use of the open source packet analyzer

Wireshark.

Wireshark stable release version 2.6.2, as of July 18, 2018 https://www.wireshark.org/.

Step 1: Starting up the KaliLinux VM within the Oracle VM VirtualBox

Step 2: One of the many Sniffing & Spoofing Applications within KaliLinux includes Wireshark

of which is used for this Week 3 assignment.

9|Page
It seems I have a privilege rights issue with properly running Wireshark as a superuser. The system

is prompting me to run Wireshark as an unprivileged user.

This is a known error with running Wireshark as a superuser, yet after I selected the appropriate

interface eth0 I don’t seem to have any issues with capturing packets from a streaming YouTube

video. One of the first sites to capture packets from is from YouTube: The Complete Wireshark

Course: Beginner to Network Admin https://www.youtube.com/watch?v=XTSc2mPF4II.

To remedy the Lua: Error during loading the Wireshark application I created an administrator

account. Logging into and running Wireshark under the new administrator account did not

generate the Lua: Error during loading.

Step 3: The laptop this VM is running from is connected to the internet through the eth0

connection. The interface selected is eth0.

Step 4: I set the eth0 interface to Promiscuous Mode. Selecting Promiscuous Mode option for eth0

allows Wireshark to capture all packets to later be analyzed. Though it’s important to know from

what point on the network the packets are being captured from - the switch, router or other end

point. Even though the Promiscuous Mode is selected it may not be capturing all data flow packets

due to settings on these network devices.

 IPv4 address for eth0:192.0.2.1 with Link-Layer

Header of Ethernet.

 IPv6 address for eth0: 2001:db8::1

 Fixed MAC: 00:00:5e:00:53:00

 Filters Selected to allow capture of: TCP or UDP,

Week 7 Assignment Ricardo Nevarez

HTTP port (80)

More Capture Filter detail of eth0 is provided in the screenshot .

The captured packets are from one internet browser connection. One from an SSL website.

 SSL website: https://www.virtualsheetmusic.com/violin/duets/

Screen capture of IP packets captured from SSL website virtualsheetmusic.com/violin/duets

Screen captures of TCP segments captured.

Screen captures of encrypted messages captured.

Line 22: the client sent out a Hello and the server ACK. Server responds with the Encrypted

Handshake Message. Client Key Exchange occurs. Line 36: is the encrypted Application Data with

HTTP over TLS.

Lessons learned from this assignment.

We know using HTTPS (TLS/SSL) minimizes the man-in-the-middle threat (preventing

eavesdropping) between the client and server. Using Wireshark allows the security engineer to

visually see a representation of the network packets coming from the Client to the Server. The

11 | P a g e
security engineer can see where the client is establishing a TLS/SSL connection with the server

and can see where the encrypted connection occurs during the client/ server handshake. Another

use of Wireshark (packet analyzer) is to view the network during high traffic and see from where

and to what ports the data is flowing during a specific set time frame. This is also an effective tool

to monitor the network at different points and see what sort of traffic is going through a certain

port in time. It also can help the security engineer to track down particular protocols from and to

network interfaces to later analyze and allows the security engineer a rough look of the overall

data flow within the organization’s network (Bullock & Parker, 2017).

Week Four (4) Assignment – Trade Study includes virtualized lab architecture

The following five (5) steps walk through a trade study that requires using a number of

vulnerability scanning tools of which I have personally selected Nmap and the requested tool

NESSUS.

Nmap release version 7.70 as of 2018 https://nmap.org/

NESSUS release version 7.1.3 as of July 31, 2018 https://www.tenable.com/downloads/nessus

Step 1. My criteria with Nmap is to scan the first 1000 out of 65,535 ports on my target VM. I will

be looking for open ports. Once I know what the open ports are and what protocol is associated to

it, I can close those respective ports considered to be potential access vulnerabilities. In regard to

monetary cost it comes included within the KaliLinux OS. Cost considerations will include a

strong workstation with a connection to the internal computer network. Other costs could

potentially come from legal in regard of running this port scanner without permission from the

organization, because it can be considered Computer Fraud and Abuse Act of America Section

1030(a)(5)(B).

Scanning is very simple especially through the GUI. The other option is using CLI. Using the GUI,

simply selected the targets IP or domain address or network and then select the appropriate profile
Week 7 Assignment Ricardo Nevarez

scan of which are: intense scan, intense scan plus UDP, intense scan, all TCP ports, ping scan,

quick scan, quick scan plus, quick traceroute, regular scan or slow comprehensive scan. Next, click

Scan. Once the scan is complete the results will displayed in a separate window. Documentation

is easily found doing a search or visiting Nmap’s website https://nmap.org. In regard to update

frequency, they are always working and making available new versions with better services. The

most current is Nmap 7.70 announced March of 2018. With regard to compatibility with CVE,

Nmap is very compatible. Scripts can be created to generate CVE information for services of which

will include SSH, RDP, SMB, etc. Here is an image running such a script

Criteria for NESSUS

The set criteria for Nessus is the same as for Nmap. It is also to scan the first 1000 ports then within

any found open ports, attach those respective open ports for vulnerabilities. There is monetary cost

per year of $2,190.00. I believe security companies in the business of providing cybersecurity to

organizations can justify this reoccurring yearly cost. Regarding its complexity, there are many

options to choose from of which include Advanced Scan, basic network scans, credential patch

audit and more. It is much more comprehensive than Nmap.

13 | P a g e
Documentation availability is found directly from Tenable.com

https://docs.tenable.com/nessus/Content/GettingStarted.htm. Updates are provided daily and in

real-time. Compatibility with CVE is utilized through the Security Center Continuous View. This

is a dashboard that provides extensive CVE analysis information that includes Outstanding CVE

breakdowns, Top 25 CVE issues, CVE mitigated within the last 30 days, Outstanding CVE totals

by year including CVE by Collection Method.

Step 2. The two vulnerability scanning tools I have selected are NMAP and the recommended

Nessus. Nmap doesn’t require to have special privileges to use and has speed on its side, yet from

the targets perspective can be easily detected and filtered. Nessus uses real attacks to detect

vulnerabilities on the target machine such as RDP, misconfigurations, default passwords, etc.

Nessus will first scan for open ports and then detect for vulnerabilities.

Step 3. The most effective of these two vulnerability scanners are both Nmap and Nessus.

Step 4. Nessus installation procedures: Nessus will not be found within Kali-Linux. The trial

version has been downloaded from the Tenable website for evaluation

Registration is required to obtain the Nessus Professional Evaluation activation code. Note that

this evaluational product is limited in funcationality and the evaluation expires in 7 days.

Relocate the file to the Downloads folder. To install Nessus run the following command
Week 7 Assignment Ricardo Nevarez

Start Nessus by running the command

Nmap installation is not required since it’s included within the KaliLinux OS and can be found

under Applications/Vulnerability Analysis.

Step 5. Nessus configuration: From a browser go to https://kali:8834/. An insecure webpage will

come up. This is basically telling you this is using an invalid security certificate. For this

assignment ADD the exception to go to the Create an Account to use Nessus. Create and enter a

username and password. My suggestion for this assignment is to keep the credentials simple. Next

copy the activation code that was previously emailed. If you successfully got this far the plugins

are downloaded to scan assets. This process may take awhile. Nessus is web based.

Now the configuration for scanning is done by clicking on New Scan

NMAP configuration can be set up within the CLI. For example, to scan the first 1000 out of

65,535 ports using the following command-

Nmap -v -A target IP. Image shows the target IP of 192.168.1.241

15 | P a g e
Week Five (5) Assignment includes virtualized lab architecture

Studying the various open source cybersecurity tools includes the use of the Metasploitable VM

platform. This VM is purposely designed to be insecure in every regard to further pursue the study

of applicable cybersecurity tools and analyzing vulnerabilities. The use Nmap and Metasploitable

VM will be used within this assignment.

Nmap release version 7.7.0 2018 https://nmap.org/

Metasploitable 2017 https://information.rapid7.com/download-metasploitable-2017.html

Step 1The steps for this assignment are found on the following URL

https://metasploit.help.rapid7.com/docs/metasploitable-2-exploitability-guide

Step 2 The assignment calls to have the lab include a source and a target. I named each VM

accordingly. The NIC’s on each machine have been set to NAT Network.

Step 3 Getting Started

Running ifconfig from the CLI on both the Source and Target

Source inet 192.168.0.4 netmask 255.255.255.0 broadcast 192.168.0.255

Target inet 192.168.0.5 netmask 255.255.255.0 broadcast 192.168.0.255

I pinged the other’s IP to confirm connectivity between the two (2) computers.

Services

Identify open TCP ports within all 65535 available ports on PC2 using the command

Nmap -p0-65535 192.168.0.5. Seems to take some time. Notice it’s at 60% complete. I ran it on

all hosts. I should have simply run it on one host – the local host. I ended up stopping after 20mins.
Week 7 Assignment Ricardo Nevarez

Next: run rlogin -l 192.168.0.4. My results say

Next: run rpcinfo -p 192.168.0.4. My results say

then I tried to run showmount -e 192.168.0.4. My results say

Next: run ssh-keygen – no results.

I installed rsh-client because I was getting this, then reran ssh-keygen with the same results.

Next: Telnet from the Source to Target 192.168.0.4. My results

Next: Exploiting through port 6667. My results of this attempt from the Source to the Target

17 | P a g e
Next: Telnet through port 1524. My results of this attempt from the Source to the Target

During this next step I got a .NET Framework Exception error. I clicked on Continue.

Next: Exploit backdoor. My results

Next: Access through a file share. My Results

Next: Accessing a web application on IP 192.168.56.101. This resulted with a timed out page.
Week 7 Assignment Ricardo Nevarez

Next: Required to access the web applications not possible from not gaining access to the IP

192.168.56.101. I was able to find what seems like the download application on Sourceforge.

Next: Continue to explore the other readily available web applications on 192.168.56.101. I was

not able to continue since this IP address timed out.

Lessons learned from this assignment. I ran in to many difficulties that required many hours of

trial and error to get with completing one scan with open ports. Initially I was not able to get both

the Source and the Target to communicate. Took different approaches to resolve the issue with no

real permanent solution. I manually updated the IP address, changed the NIC options and still was

not able to update the IP addresses. Many readily suggestions are available on the internet, but

these options did not work. To resolve this issue, I wiped out all VM’s and started from scratch

with carefully keeping in mind with the NIC settings. I set it to 192.168.0.0/24 on both the Source

and Target VM’s. After powering up each VM, each pulled its own unique IP address of

192.168.0.4 and 192.168.0.5. I was easily able to ping each machine at this time. Running Nmap

on 192.168.0.0 seem to take longer than 20mins to complete. I was able to use Nmap to identify

two (2) open ports:

19 | P a g e
I believe the issue during this assignment is that

perhaps the ISO of my Kali Linux is corrupted? I

will be downloading a fresh new copy tomorrow

and attempt to rerun some of the exploits of which I

really was looking forward to doing.

Week Six (6) Assignment includes virtualized lab architecture

My sixth and final assignment includes researching the open source wireless Kismet network

analyzer that runs on the Linux, and Mac OS X platform and of which allows the security

professional to use the packet sniffer, network detector, and intrusion detection system on wireless

networks.

My research shows there are more than a few platforms to run Kismet including Windows,

smartphones with android devices (requires specific android versions), and raspberry pi. Before

kismet can properly run within KaliLinux it requires the setting up of guest additions within the

Oracle’s VirtualBox. My attempt to run Kismet generated the error response. As shown here. From

the message I am led to believe that the executable is not working.

Week 7 Assignment Ricardo Nevarez

Next, within the KaliLinux terminal box I ran the apt-get update

Next, I ran the command apt-get install -y virtualbox-guest-x11

Next, I restarted the KaliLinux vm. The reboot step took approximately 2 minutes.

Next, to download and install Kismet with a graphical interface, I ran as root the following within

the CLI #apt-get install kismet

With having an external wireless card, I would direct the wireless card NIC interface to the

/kismet.conf configuration file within /etc/kismet

I was able to open up the text editor to the kismet.conf. From here I can amend the configuration

file to my wireless NIC. From within this file is where I can change the source to my computer

21 | P a g e
with the external Wi-Fi NIC (Kershaw, 2014). Because an external NIC is not connected, the

kismiet_drone.conf cannot be activated. Another error generated in this attempt is Kismit not

finding the ssid_map.conf or tag.conf file or directory.

Next, I shot down Kismit

I would then put the wireless card in monitor mode using sudo airmon-ng. Reopening Kismet

along with the name of the wireless card. Once I have the kismet server running, it can start picking

up wireless networks. Some of the features included within kismet is finding those networks that

hide their ssid’s. Kismet will use channel hopping in this instance. The results can include the AP,

mac and ssid’s, channels used, encryption type, the number of packets being transmitted within

the network, including MACs connected to specific AP’s (thecybersecurityman, 2018). The

information screen of kismet can provide information to the elapsed time kismet has been running,

the number of networks it can see, the number of packets captured, the number of packets

discarded, including the number of packets per sec (thecybersecurityman, 2018)

Image of the kismet server interface.

Week 7 Assignment Ricardo Nevarez

Setting up the wireless card

Next, networks detected/ packets captured by kismet

23 | P a g e
Regarding the color scheme, is as follows:

 Yellow: encrypted via WPA/ WPA2

 Red: Encrypted via WEP

 Green: no encryption (open)

 White: client list unknown

Additional features available is a graphical representation of gps coordinates of the networks seen.

In conclusion to this assignment six (6), the kalinux tool is great for penetration testing a networks

security. It has the capability of running in passive and active reconnaissance regarding the

identification of internet networks. The functionality of kismet can be extended by bolting on

additional applications such as Wireshark and airsnort. In conclusion, the Kismet application is a

useful tool in the toolbox for the cybersecurity professional.

Security Toolkit

Nmap (network mapper)

 Open source and free security scanning that runs on Linux based systems

 Identify host and ports

 Network inventory, including asset management

Week 7 Assignment Ricardo Nevarez

 Detects remote hosts installed application names, version number, OS, including

hardware running on host.

 Reverse DNS names and MAC addresses.

Metasploitable

 Ruby based. Uses a few interfaces including Armitage.

 Console driven application, and all capabilities are available as modules

 Used for pentesting to identify security vulnerabilities

 Uses the metepreter shell for post exploitation

 Used to gather information, scan for vulnerabilities, and reporting

NESSUS

 Non-destructive open source remote vulnerability scanner

 Gathers data, identifies hosts, port scanning

 Client/ server and runs on the Windows and Unix platform.

 Uses the NASL scripting language

 Unlimited host scanning capabilities (depends on capacity of hardware)

 Create custom reports by vulnerability or host to xml, pdf, html, or csv file format

 Vulnerability scans the IPv4/ IPv6 and hybrid computer networks

 Scans multiple platforms including Windows, Mac, Linux, Solaris, BSD, Cisco iOS

 Detect viruses, malware, backdoors including hosts that communicate with botnet

infected hosts.

WireShark

 Runs on multiplatform and is gui based

 Includes VoIP analysis

25 | P a g e
  Decryption support for IPsec, isakmp, Kerberos, snmpv3, ssl/ tls, wep, wpa/ wpa2

 Live captured data can be read from ethernet, 802.11, ppp/ hdlc, atm, Bluetooth, usb,

 Token ring, frame relay, fddi, and more (really depends on the platform)

 analyze packets. Captures network traffic, decodes packet protocols using dissectors.

 Used to troubleshoot network problems

 Widely used in the IT industry

 Displays in great detail captured network traffic packets from many protocols.

 Able to filter what needs to be viewed

 All output can be exported to xml, postscript, csv or simple plain text.

Kismet

 Sniffer, wireless network detector, and intrusion detection system.

 Features: 802.11 sniffing

 Standard pcap logging (compatible with wireshark, tcpdump)

 Uses the client/ server modular architecture

 Multiple capture sources

 Live export of packets to other tools via tun/ tap virtual interface

 Distributed sniffing via light-weight remote capture

 Xml output for integration

Gephi

 Open source interactive exploration software for graph and network analysis

 Runs on many platforms including Windows, Mac OS X, and Linux

 Able to display optimized 3D rendered displays using force-based algoritms of large

networks in real-time.
Week 7 Assignment Ricardo Nevarez

 Up to 100k nodes and 1million edges capabilities (depends on capacity of hardware)

 Ability to import GEXF file formats

 Ability to create custom cartography in the pdf, svg, and png file type format.

 Create query filters

 Ability to read most graph file formats, including csv and relational database imports.

Security Tool Played Within the Test Lab

Role of KaliLinux – is Debian based operating system that is used for cybersecurity assessments

of computer networks. It is used for many things including and not limited to penetration testing

and security auditing of computer networks. The tasks Kali Linux includes are information

gathering, sniffing and spoofing, vulnerability analysis, post exploitation, web application

analysis, forensics, database assessment, reporting tools, password attacks, social engineering

tools, wireless attacks, reverse engineering, exploitation tools and system services.

Role of WebGoat – webbased application security assessment testing platform that provides hands

on lesson plans within a blackbox in the following areas: http basics, http splitting and cache

poisoning. Including exploiting threads, hidden fields, unchecked email, forgot password pages

and much more.

Role of Metasploit – used within a testing environment includes exploiting ports by first scanning

Metasploit from a source computer using Nmap, or Nessus. It allows me to test and exploit known

vulnerabilities in a controlled KaliLinux environment. It is also a platform that can allow me to

analyze new security tools on existing known vulnerabilities.

Role of Nmap – used within a test lab it allows to analyze networks, including port analysis onto

targets like Metasploit, including its many inherent vulnerabilities.

Role of Wireshark- in this controlled lab environment it allows the practice of analyzing network

traffic. Allows to uses filters on packet types. Including the ability to capture packet types that
27 | P a g e
include and not limited to tcp/ ip, ppp, ethernet, hdlc, arp requests and much more. All in a

controlled test lab. This is not something that is advisable to do on a live network.

Role of Kismet – in a controlled environment allows the reconnaissance collection of packets in

real time over HTTP. It is used as an intrusion detection system.

Role of NESSUS – as a vulnerability is used within a lab to analyze attack methods on systems

such as Metasploit. Nessus will also use the CVE (Common Vulnerability and Exposures)

vulnerability identifier. From this we can see if there is an exploit that can be taken advantage of.

Thoughtful Reflection

For a systems administrator responsible for maintaining, managing and securing a computer

network system that also allows secure wireless these security tools allowed me to explore and

analyze security tools within a safe secure environment. Also within these respective labs, gave

me practical examples with identifying, capturing and analyzing real world applications. It has

allowed me hands on examples on a secure platform of how to install, configure and set up these

tools in ways that I can personally use on a real network within an organizations real-world

computer network. Within a controlled lab environment platform such as within Oracle’s VM and

the use of KaliLinux it has allowed me to use these very important security tools without the danger

of breaking something on a real network environment. I have learned that these tools should be

used in a professional ethical manner and never be used without permission on a real-world

network environment or for nefarious personal reasons. Another important lesson learned are the

benefits of using trade studies to vet security tools that are applicable to particular networks.

Moving forward, this is my go to lab environment on my personal laptop to experiment, and

explore new vulnerabilities, develop new techniques regarding the use of existing and new

cybersecurity tools, and analyzing existing software security vulnerabilities found in malware,
Week 7 Assignment Ricardo Nevarez

viruses, port scanning and more. Being able to see firsthand how these vulnerabilities work and in

a controlled platform, I will be better prepared as a network security professional.

29 | P a g e
 References
Bullock, J., & Parker, J. T. (2017). Wireshark for Security Professionals: Using Wireshark and
the Metasploit Framework. Indianapolis, Indiana: John Wiley & Sons, Inc. Retrieved
July 29, 2018
CentOS. (2018). Download CentOS. Retrieved August 24, 2018, from Centos.org:
https://www.centos.org/download/
Kershaw, M. (2014, February 18). Kismet. Retrieved August 22, 2018, from Kali.tools.org:
https://tools.kali.org/wireless-attacks/kismet
Linux, K. (2018). Kali Linux Downloads. Retrieved August 24, 2018, from Kali.org:
https://www.kali.org/downloads/
NMAP. (2018). Download Nmap. Retrieved August 24, 2018, from nmap.org:
https://nmap.org/download.html
Oracle. (2018). Oracle VM VirtualBox. Retrieved August 24, 2018, from Oracle:
http://www.oracle.com/technetwork/server-storage/virtualbox/downloads/downloads-
176856.html
Team, G. (2018). The Open Graph Viz Platform. Retrieved August 2018, from Gephi.org:
https://gephi.org/
Team, P. (2008, August 25). Network Workbench Download. Retrieved August 2018, from
Network Workbench: http://nwb.cns.iu.edu/download.html
Team, P. (2017). Installing Gephi. Retrieved August 2018, from Gephi.org:
https://gephi.org/users/install/
thecybersecurityman. (2018, March 22). PenTest Edition: Kismet Wireless. Retrieved August 20,
2018, from thecybersecurityman.com:
https://thecybersecurityman.com/2018/03/22/pentest-edition-kismet-wireless/