Essentials of Penetration Testing: Expectations and Performance

Slide Note
Embed
Share

This presentation delves into the realm of penetration testing, outlining the basic expectations and performance aspects. It emphasizes the importance of clear planning, client-side and auditor-side negotiations, and commencing the audit process diligently. With insights into the types of audits, scope definition, and client interactions, it serves as an educational guide for individuals interested in understanding the nuances of penetration testing within ethical boundaries.


Uploaded on Sep 15, 2024 | 0 Views


Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

E N D

Presentation Transcript


  1. Business of Penetration Testing Basic Expectations and Performance

  2. Disclaimer Hacking is illegal and should not be performed. This presentation does not condone or approve of hacking in any way. Penetration Testing is an agreed form of audit between two parties and should be bound in writing defining the scope and nature of what is to be audited. This presentation is solely for academic and educational purposes only.

  3. What will be covered Initial planning of the audit External Scanning/Footprinting Internal Scanning Vulnerability Assessment John the Ripper usage Metasploit basics Post-audit reporting

  4. What is Penetration Testing Type of audit to assess security of a system Provides feedback to the stakeholder what their security posture is like Enumerates weaknesses and gives countermeasures/suggestions to strengthen

  5. Planning an Audit Penetration Test may be included in a scheduled audit or independently May be announced or unannounced Define the scope Decide who will perform the audit Conflict of interest Non-trusted party

  6. Client-side Negotiations Ensure the scope is clearly understood by both parties Understand what the auditors are capable of testing Certified? As the client negotiating, remain in control Get bids- Gives a good comparison of prices

  7. Auditor-side Negotiations Understand your responsibility to the client Your access/attempted access will be privileged Try to be as non-invasive as possible unless given permission Sometimes a proof-of-concept is all that s needed The client expects a report. Ensure deliverables are agreed on

  8. Beginning the Audit Business is at stake, know when to begin Remember that this is an audit and that every activity must be documented External activity is not exempt from documentation. Keep a mindset as if you were collecting evidence Prepare your tools Run updates on your software Pack extra batteries

  9. Logistical Planning Planning is crucial for every step taken Plan to meet Plan for introductions Plan for the surprise attacks Plan for the unexpected Plan to introduce presence to the unsuspecting In cases of unannounced audits, special actions may need to have preparations in case caught or blown cover

  10. External Port Scanning Port scanning from the internet is simple Need the public IP Address for the company Run a port scanner (NMAP) with options and discover what port are open. If a known port is found, scripts are good at discovering the security state of that port. Scripts that are available online can be a huge threat since anyone can use them.

  11. Email Tracing Look at email traces. Provides IP Addresses to mail servers IP Addresses can lead to more destinations on the internet for scanning and profiling Down side IP Addresses can lead to web hosted email services Sometimes the PTR s can lead to a host with a robust firewall as a dead end.

  12. Web Site Profiling Web site can give good information when looking for emails, executives, and technical staff. Excellent for social engineering attempts. If there are interactive web pages, further research can uncover exploitable items (XSS,web injections, or simple valid queries)

  13. Internal Testing Depends on the scope and plan Performing undercover scans and testing is best done before introducing to the unsuspecting. Good time to also social engineer, test policies, and scan wireless Test policies for information control Use kismet or other wireless scanner

  14. Internal Testing After presence is known, ensure the IT staff knows what type of testing will be performed, expectations of event logs, and NOT to adjust security posture during the audit.

  15. Begin Scanning Survey the network in any case whether you know the network diagram or are blind testing Scans include all devices on the network, their Operating System, open ports, and services running If feasible, look for open access ports to the network in discreet areas. Ideal for placing your own wireless access points

  16. Network Scans Try the low hanging fruit Check network places and shared drives for unrestricted access. Copy machines may have onboard hard drives with file sharing Users may know enough to be dangerous sharing folders

  17. NMAP Network scanner Identifies devices and Operating Systems More quiet than pinging devices Uses the REQ,ACK,SYN for communications Returns open ports and has options for more stealthy operations on a sensitive network

  18. Vulnerability Scanners Nessus Free for personal use Linux can use apt-get Windows can download Requires registration before usage openVAS Spin off of Nessus http://www.openvas.org/

  19. Nessus Enumerates vulnerabilities per device Web GUI provides easy usage and real-time enumerations Works with Metasploit to provide a scan and attempt at known vulnerabilities Requires database for saving Nessus scans Use the Search in Metasploit to find modules relating to scans to begin probing

  20. John the Ripper Offline password cracker Used on SAM dumps, LANMAN, most types of password hashes Can also be used to generate mangled wordlists for uses with other tools. Know the how to write rules in john.conf file Output file can be in a txt format Remember the john.pots file

  21. Medusa or Hydra Online password cracking Great for dictionary attacks (wordlists) Best if used on known open ports Wordlists can be found online and mangled with JTR for more complex P@55w0rds!

  22. Pointers When Using Tools Read any precautionary comments before starting. Some exploits could cause damage to databases or resources costing your client money Try not to use client s network to do quick research, it could contaminate results Advise IT staff of certain network loading tests and log expectations Ask, when in doubt if a critical resource is discovered vulnerable, about exploiting Proof-of-concept may be all that is needed

  23. Metasploit Metasploit is an open source platform supports vulnerability research exploit development creation of custom security tools Included in BackTrack distributions Recommend intense training to master Metasploitable VM download

  24. What is Happening... Known vulnerability occurs in victim Related exploit is set in Metasploit Options are configured for the victim Payloads are viewed and selected Payloads are what the attacker wishes to happen Exploit occurs causing the victim process to crash Payload is triggered

  25. Pushing Greater Limits Metasploit offers much more than the scope of this presentation Fuzzing protocols like IMAP and TFTP Writing fuzzers can become the first step to creating new exploits Good for protocols on the network that have no known module Password sniffing on the wire Creating backdoors to maintain access

  26. Wrapping Up The Audit Check for any open activities Confer with IT staff that all network activity is normal Ensure all documentation is collected

  27. Post-Audit Generate documentation of all work performed Official audit report to the client Should incorporate summaries, details, and exhibits Include screenshots and pictures taken Describe details of each action and what threat it presents

  28. Presentation In most cases, a brief presentation to client and selected staff will be performed Include most significant threats discovered and solutions Emphasize the impact of all negative findings to the business Include positive notes where security was solid

  29. Post-Audit Report Audit report is a confidential document to the client It is an official report that will be integrated into reports of other audits for that client Use encryption if delivering by email Exercise infosec in all cases regardless of method used for communications Be thorough, use passive writing, use pictures

  30. In Conclusion Instill confidence in your client and yourself Know your capabilities and limits, personally and legally Perform a thorough audit documenting as you go Sharpen and research tools Deliver solid feedback and suggestions

  31. Questions

  32. References & Research Sites http://www.offensive-security.com/metasploit- unleashed/Main_Page http://www.openwall.com/john/ http://www.openwall.com/john/doc/RULES.shtml http://thc.org/thc-hydra/ http://www.foofus.net/~jmk/medusa/medusa.html http://www.tenable.com/products/nessus http://nmap.org/ http://www.backtrack-linux.org/ https://www.owasp.org/index.php/Main_Page

Related


More Related Content