Web App Penetration Testing – Configuring virtual machines for correct communication
In our latest articles on Web App Penetration Testing with Kali Linux, we spoke about creating a vulnerable virtual machine and a client virtual machine, in this article we will explain to How to configure the virtual machines for correct communications.
To be able to communicate with our virtual server and client, we need to be in the same network segment; however, having virtual machines with known vulnerabilities in our local network may pose an important security risk. To avoid this risk, we will perform a special configuration in VirtualBox to allow us to communicate with both server and client virtual machines from our Kali Linux host without exposing them to the network.
Before we proceed, open VirtualBox and make sure that the vulnerable server and client virtual machines are turned off.
How to do it…
1. In VirtualBox navigate to File | Preferences… | Network.
2. Select the Host-only Networks tab.
3. Click on the (+) button to add a new network.
4. The new network (vboxnet0) will be created and its “details window” will pop up.
If it doesn’t, select the network and click on the (Edit) button to edit its properties.
5. In this dialog box, you can specify the network configuration, if it doesn’t interfere with your local network configuration, leave it as it is. You may change it and use some other address in the segments reserved for local networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
6. After proper configuration is done, click OK.
7. The next step is to configure the vulnerable virtual machine (vulnerable_vm). Select it and go to its settings.
8. Click Network and, in the Attached to: drop-down menu, select Host-only Adapter.
9. In Name, select vboxnet0.
10. Click OK.
11. Follow steps 7 to 10 in the client virtual machine (IE8 – Win7).
12. After having both virtual machines configured, let’s test if they can actually communicate. Start both the machines.
13. Let’s see the network configuration of our host system: open a terminal and type:
14. We can see that we have a network adapter called vboxnet0 and it has the IP address 192.168.56.1. Depending on the configuration you used, this may vary.
15. Log into vulnerable_vm and check its IP address for adapter eth0:
16. Now, let’s go to our client machine IE8 – Win7; open a command prompt and type:
17. Now, we have the IP addresses of our three machines:
192.168.56.1 for the host
192.168.56.102 for vulnerable_vm
192.168.56.103 for IE8 – Win7
18. To test the communication, we are going to ping both virtual machines from our host:
ping -c 4 192.168.56.102
ping -c 4 192.168.56.103
Ping sends an ICMP request to the destination and waits for the reply; this is useful to test whether communication is possible between two nodes in the network.
19. We do the same from both the virtual machines thus checking communication to the server and the other virtual machine.
20. The IE8 – Win7 machine may not respond to pings; that’s normal because Windows 7 is configured by default to not respond to ping requests. To check connectivity in this case, we can use arping from the Kali Linux host:
arping –c 4 192.168.56.103
How it works…
A host-only network is a virtual network that acts as a LAN but its reach is limited to the host that is running the virtual machines without exposing them to external systems. This kind of network also provides a virtual adapter for the host to communicate with the virtual machines as if they were in the same network segment.
With the configuration we just made, we will be able to communicate between a client and server and both of them can communicate with the Kali Linux host, which will act as the attacking machine.
If you have encountered a problem or you have any questions or remarks please feel free to set a comment.
If this article helped you to solve your problem please feel free to share it with your friends … with love and prosperity K4LINUX–TEAM.
With Love and Prosperity K4LINUX-TEAM.