admin/ September 5, 2018/ OSCP/ 0 comments


UPDATE :  PWK starts on January 2nd 2019. As I said in the previous post I will be using the Georgia Weidman; Penetration Testing, A Hands-On Introduction to Hacking book to guide me on my preparation for OSCP PWK course. From what I’ve read so far, this book (along with other resources) gives the basis and knowledge which will be very helpful when taking the OSCP PWK course. 

My first goal was to get the lab done. This book is from 2014 and as you may imagine not all resources to download from the links provided in the book are still valid. I had to google for while but at the end I managed to get them working.  I am using VirtualBox instead of Vmware.

  • KALI LINUX:

I already had a VM configured so did not need to download it.

For the initial configuration I did the following:

  • Upgraded the newest version –  2018 3
  • Enabled SSH 
  • Changed Kali default password
  • Created another user

Some tools are not allowed to be used in OSCP exam but that does not mean you cannot use them to practice and learn. The book uses Nessus so Installed it to see how it works and so on. 

You cannot use any of the following on the EXAM:

  • Spoofing (IP, ARP, DNS, NBNS, etc)
  • Commercial tools or services (Burp Pro, etc.)
  • Automatic exploitation tools (e.g. db_autopwn, browser_autopwn, SQLmap, SQLninja etc.)
  • Mass vulnerability scanners (e.g. Nessus, NeXpose, OpenVAS, Canvas, Core Impact, SAINT, etc.)
  • Features in other tools that utilize either forbidden or restricted exam limitations
  • Metasploit Pro can be used only in 1 machine.

Any tools that perform similar functions as those above are also prohibited.

TOOLS INSTALLED:

  • Nessus – Automated Vulnerability Scanner
  • The Ming C Compiler – A cross compiler so we can compile C code to run on Microsoft Windows systems. The Ming compiler is included in the Kali Linux repositories but is not installed by default.
  • Hyperion – We’ll use the Hyperion encryption program to bypass antivirus software. Hyperion is not currently included in the Kali repositories. Download
    Hyperion with wget , unzip it, and compile it with the Ming cross compiler. The procedure to install The Ming C Compiler and Hyperion can be found at https://www.cybrary.it/forums/topic/how-to-make-hyperion-exe-work-in-kali/.
  • Veil-Evasion – Veil-Evasion is a tool that generates payload executable you can use to bypass common antivirus solutions. Installation process from the book is still valid.
  • Ettercap – Ettercap is a tool for performing man-in-the-middle attacks. Once installed follow steps from the book.

root@kali:/# apt-get install ettercap-graphical
Reading package lists… Done

  • WINDOWS XP:

I already had a Windows XP VM configured so did not need to download it.

For the initial configuration I did the following:

  • Set static IP Address (Bridged)
  • Made windows XP Act Like It’s a Member of a Windows Domain

Installed the following vulnerable software:

Torrent is available at the no statch press site.

  • Windows 7

I already had a Windows 7 VM configured so did not need to download it.

For the initial configuration I did the following:

    • Set static IP Address (Bridged)
  • Set second network interface (Host-Only Adapter)

 Install Additional Software:

    • Java 7 Update 6 JRE – Link provided above.
    • Firefox – Latest version.
    • Microsoft Security Essentials – Installation process from the book is still valid.
  • BookApp ( SQL server) – Downloaded along with Ubuntu image from no starch press. For this one please strictly follow the installation process it comes with it called InstallApp.pdf. If it doesn’t work after you installed it, then reboot the VM.

That’s it! I am set to move on to the next chapters. I will keep you posted. 🙂 

Please check out the other posts related to my OSCP preparation!

Week 2 – OSCP Preparation / Linux Review Part I

Week 2 – OSCP Preparation / Linux Review Part II (Netstat, SS, NETCAT, NCAT )

Week 3 – OSCP Preparation / (Wireshark, tcpdump, Shell Script and Python)

Week 4 – OSCP Preparation / Information Gathering Part I

Week 4 – OSCP Preparation / Information Gathering Part II (Recon-ng)

Week 5 – OSCP Preparation / Information Gathering Part III (DNS Reconnaissance / Enumeration)

Week 5 – OSCP Preparation / Information Gathering Part IV (NMAP)

Week 6 – OSCP Preparation / Information Gathering Part V (Enumeration / Vulnerabilities Analysis)

Week 7 – OSCP Preparation / Buffer Overflow

Week 8 – OSCP Preparation / Exploit

Week 9 – OSCP Preparation / Post Exploitation

Week 10 – OSCP Preparation / Port Redirection and Tunneling

Week 11 – OSCP Preparation / SQL Injection

Week 15 – OSCP Preparation / PWK > Let’s roll!

Week 19 – OSCP Preparation / PWK > Exercises DONE!

http://addurl.nu

Share this Post

Leave a Comment

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>