Penetration Testing

This exercise was an opportunity to use network penetration tools to conduct an assessment of a known vulnerable web application. This exercise was conducted in a virtual lab with consent from all of the system owners and was for education purposes only.  
Metasploit Pen Test:

  

For my penetration testing of the Metasploitable server, I started with Zenmap. Zenmap scanned the target IP and revealed several of the host’s details including the 23 open ports:

21 22 23 25 53 80 111 139 445 512 513 514 1099 1524 2049 2121 3306 5406 5432 5900 6000 6667 8009

Operating system is general purpose linux 2.6.X

 

 

Services Vulnerable to attack:

My scans found 13 open services running, potentially vulnerable to attack. These were:

http dns sunrpc (8) nfsd netbios portmap

 The web applications were vulnerable to traversal attack (via OWASP ZAP).

DoS attack on this site can could be executed using a tool such as pentmenu https://github.com/GinjaChris/pentmenu. Pentmeny can use a variety of DoS attacks including SYN, ACK, and RST floods,  UDP flood, SSL Flood, slowloris, and others.