Scribd
Upload
78 views33 pages

Penetration Testing Print Version

Uploaded by

arnold sopiimeh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
78 views33 pages

Penetration Testing Print Version

Uploaded by

arnold sopiimeh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 33

Network penetration testing

Marek Kumpošt
Penetration testing

> Authorized attempt to violate specific constraints defined in a form


of a policy

> Technique to discover, understand, and document all security holes


found in a system

> Not restricted to network only

> Penetration testing can prove presence of a security flaw

> But not their total absence


Penetration study

> Complex process to evaluate (through penetration testing) the


strength of all security controls within the system/network

> + suggestions how to fix them

> The goal of a penetration study is also finding interpretations


(causes) of discovered vulnerabilities and to suggest how to
remove/close them

> Not intrusive - detects/enumerate potential vulnerabilities but


does not exploit them
Lifecycle of penetration testing

> Phase 1: Information gathering about tested environment

> Phase 2: Scanning, enumeration, fingerprinting, ...

> Phase 3: Exploitation, vulnerability testing, ...

> Phase 4: Report and evaluation


Recommended tools and pentesting arsenal

https://www.kali.org/
Types of penetration testing

> Black-box pentesting


> Tester knows no details about tested environment
> Simulation of an external attacker with no internal knowledge

> Grey-box pentesting


> Tester might have some arch. details, credentials, etc...

> White-box pentesting


> Nothing is hidden from the tester in this scenario
> Arch. details, credentials, source code of tested application
Determining scope of a pentest (1/2)

> Who has the authority to authorize testing?

> What is the purpose and what is the timeframe for the testing?

> Who is authorized to know about the pentesting (IT, mngmt, ITsec.)?

> What documentation will you have (IP ranges, applications, DB, ...)?
Determining scope of a pentest (2/2)

> What are the conditions for the test to be immediately stopped?

> Will additional permissions be required for exploiting vulnerabilities?

> Are there any legal implications you should be aware of?

> Is social engineering (or physical security) also part of the pentest?
Most important part of any pentest?

> Take good notes!!! ;-)

> Of your setup, testing procedures, used tools, results, follow-ups


> Tips for tools: Dradis, MagicTree, ThreadFix or just Notepad ...
Information gathering

> Name servers, IP ranges, banners, running services


> Operating systems, IDS/IPS presence
> Technology used, network device types
> Google for anything, that might help you to build knowledge

> Find everything that you can -> prioritize, remove


misleading data -> use gathered data to develop a pentest plan
Information gathering – example with DNS
How do you get info you want?

> Network scanning – typical approach in the beginning


> List of live IP addresses – PING scan
> Information from WHOIS database – DNS name, A, MX records,
geolocation, reputation of an IP, SPAM db lookups, etc.

www.tcpiputils.com
How do you get info you want?

> Service scanning

> Basic portscan – slower scan with nmap

> Gives us information about running services


> Services fingerprinting
- possible versions of services
- used to identify vulnerabilities and help us finding
relevant exploits
PING scan of a network

> What is this technique good for?

> Get a list of live IP addresses


> Get a list of your targets, understand IP addressing structure
> Basic PING scan can be easily detected
Getting more info about targets?

> Services scanning – fingerprinting and service banners

> Get info about running services


> Versions of services
> Operating system of a server and its possible version

> Patches of a service or operating system


> Enabled modules, internal service name, ...
Service scanning with NMAP

> nmap –A is very noisy and easy to discover scan


> -sS – half-open scan, more stealthy
Basic nmap options for scanning

> --open – report only open ports of a target

> -Pn – skip host discovery (if i.e. firewall drops ping)

> T0-5 – aggressiveness of a scan 0-slowest, 5-insane

> -sA/P/X/S/T/U/M/I/C – different scan types

> -oA/G/X/N – output from nmap scan – good for import to msf
Usage of nmap
scripts

> Make sure you fully


understand any script that
you run! ;-)

> nmap –sC <target> - runs


about 50 basic set of nmap
scripts, but is very loud on
the network...
Getting information from SNMP

> Commonly misconfigured service by admins

> Great source of various information about your targets

> Default public string; non-encrypted versions, open ports on fw

> Tools in kali: SNMPenum, SNMPcheck, onesixtyone

> You get a lot of info by sending just one packet!


Metasploit – Swiss army knife for pentesting

> Previous manual work done effectively from one framework

> Great source of various information about your targets

> Results of your activities are stored in a database

> All configured (db, msf, web server) in Kali Linux


Metasploit – Swiss army knife for pentesting

> Workspaces for storing different project in msf

> Metasploit can import result from nmap

> Or you can run nmap directly from Metasploit!

> db_nmap with options you would use with standard nmap

> Metasploit prompt accepts standard Linux commands


CVE - database

> Common Vulnerabilities and Exposures (cve.mitre.org)

> Structured reference for publicly known vulnerabilities

> HeartBleed – CVE-2014-0160

> You can search for CVEs related exploits directly in msf
Pentest reporting – general guidelines

> Scope of the pentest (what/when/why/how/who)

> What is scanned, what is the goal, what is excluded, ...

> For each discovered vulnerability

> Discuss risk, impact, attacker’s skill, affected hosts

> Provide description/evidence, recommendation and references


Useful pointers

> OWASP testing guide

- https://www.owasp.org/images/5/52/OWASP_Testing_Guide_v4.pdf

> OWASP reporting guide

- https://www.owasp.org/index.php/Reporting

- Certified Ethical Hacker (CEH) certification


Questions?

Thx…

You might also like