Penetration Testing - Revision history

NKirnbauer: gendering

2024-10-23T08:57:58Z

gendering

← Older revision		Revision as of 08:57, 23 October 2024
Line 7:		Line 7:
	=== Pre-engagement Interactions ===		=== Pre-engagement Interactions ===

	Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or ~~his~~ company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.		Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or their company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

	Scope		Scope

Ikramer at 14:34, 9 March 2023

2023-03-09T14:34:13Z

← Older revision		Revision as of 14:34, 9 March 2023
Line 49:		Line 49:
	* http://www.pentest-standard.org/index.php/Main_Page		* http://www.pentest-standard.org/index.php/Main_Page

	[[Category:~~Documentation~~]]		[[Category:Pentesting]]

DCiklusic: /* References */

2023-02-05T16:50:56Z

References

← Older revision		Revision as of 16:50, 5 February 2023
Line 46:		Line 46:
	== References ==		== References ==

	* ~~https~~:~~//wikipedia~~.~~org~~		* Georgia Weidman. Penetration Testing: A Hands-On Introduction to Hacking. No Starch Press, USA, 1st edition, 2014
	* ~~https~~://~~google~~.~~com~~		* http://www.pentest-standard.org/index.php/Main_Page

	[[Category:Documentation]]		[[Category:Documentation]]

DCiklusic: /* Pre-engagement Interactions */

2023-02-05T16:49:27Z

Pre-engagement Interactions

← Older revision		Revision as of 16:49, 5 February 2023
Line 12:		Line 12:

	- Which IP addresses or hosts are in scope, and which are not?		- Which IP addresses or hosts are in scope, and which are not?

	- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?		- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?

	- Does the customer realize that even a simple port scan can crash a server or router?		- Does the customer realize that even a simple port scan can crash a server or router?

	- Are social engineering attacks allowed to be carried out?		- Are social engineering attacks allowed to be carried out?

	- Are there specific time windows where the tests should be performed?		- Are there specific time windows where the tests should be performed?


	These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.		These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

DCiklusic: /* Pre-engagement Interactions */

2023-02-05T16:49:15Z

Pre-engagement Interactions

← Older revision		Revision as of 16:49, 5 February 2023
Line 10:		Line 10:

	Scope		Scope

	- Which IP addresses or hosts are in scope, and which are not?		- Which IP addresses or hosts are in scope, and which are not?
	- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?		- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?
Line 16:		Line 17:
	- Are there specific time windows where the tests should be performed?		- Are there specific time windows where the tests should be performed?

	These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.		These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

	=== Intelligence Gathering ===		=== Intelligence Gathering ===

DCiklusic: /* Intelligence Gathering */

2023-02-05T16:49:00Z

Intelligence Gathering

← Older revision		Revision as of 16:49, 5 February 2023
Line 21:		Line 21:

	Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.		Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.


	=== Threat Modeling ===		=== Threat Modeling ===

DCiklusic at 16:48, 5 February 2023

2023-02-05T16:48:50Z

← Older revision		Revision as of 16:48, 5 February 2023
Line 2:		Line 2:

	The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.		The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

	~~== Requirements ==~~

	* Operating system: Ubuntu 18.04 bionic amd64
	* Packages: git emacs

	~~In order to complete these steps, you must have followed [[Some Other Documentation]] before.~~

	== The seven Phases ==		== The seven Phases ==

DCiklusic: Created page with "== Summary == The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == The seven Phases == === Pre-engagement Inte..."

2023-02-05T16:48:38Z

Created page with "== Summary == The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == The seven Phases == === Pre-engagement Inte..."

New page

== Summary ==

The Penetration Testing Execution Standard (PTES) defines penetration testing in 7 phases. The PTES technical guidelines contain, in particular, practical suggestions for test procedures and recommendations for security tools.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== The seven Phases ==

=== Pre-engagement Interactions ===

Setting the scope is arguably one of the most important components of a penetration test. While many volumes have been written on the various tools and techniques that can be used to gain to gain access to a network, very little has been written about the subject written about the topic that precedes penetration: preparation. Preparation. Neglecting the preparatory activities can leave the penetration tester (or his company) a number of problems, such as a Expansion of the project scope, dissatisfied customers, and even legal problems. The scope of a project defines exactly what should be tested. How each aspects of testing are performed is covered in the Order Rules section. The question to ask as a customer is: Is there sensitive equipment that needs to be handled with need to be careful with when testing? For a local bank, it can be a nuisance if the online banking pages go down for a few hours. When the online banking site of a local bank goes down for a few hours, it might upset a few customers, but would not be nearly as devastating as the compromise of a credit card database.

Scope
- Which IP addresses or hosts are in scope, and which are not?
- Are exploits allowed to be used and likely to crash a service, or should we limit ourselves to just identifying possible vulnerabilities? to be detected?
- Does the customer realize that even a simple port scan can crash a server or router?
- Are social engineering attacks allowed to be carried out?
- Are there specific time windows where the tests should be performed?

These are all questions that need to be clarified with the customer in order to avoid misunderstandings. Not to be neglected is to define in writing all the necessary information that is relevant for the penetration test. Each tester must have the authorization to perform a penetration test on the predefined target. If the target does not belong to the company (e.g., the web server is hosted by a third party provider), it is important to ensure that the customer has the formal authorization from the third party to perform the penetration test.

=== Intelligence Gathering ===

Intelligence Gathering is the process of reconnoitering a target to gather as much information as possible that can be used to penetrate the target in the vulnerability assessment and exploitation phase. The more information one can this phase, the more attack vectors one can exploit in the future. Reconnaissance is achieved with the use of tools such as port scanners to gain to get a picture of what systems are on the Internet or internal network and what services are and which services are running there. Open Source Intelligence (OSINT) is a form of information gathering in which information from publicly available sources is searched sources is searched, selected and analyzed to gain actionable insights. gain.

=== Threat Modeling ===
Threat modeling is about identifying and communicating information about the threats that may can impact a particular system or network. Security threat modeling enables an IT team to understand the nature of the threats and how they may impact the network. In addition, threat modeling can be used to analyze the dangers that threats pose to applications, taking into account their potential vulnerabilities. Based on the data found during information gathering, one develops strategies to penetrate a customer's systems. For example, if the customer develops proprietary software, an attacker could disrupt the company by gaining access to the internal development systems where source code is developed and tested, and sell the company's trade secrets to a competitor.

=== Vulnerability Analysis ===
Vulnerability testing is about discovering vulnerabilities in systems and applications that can be exploited by attackers. These vulnerabilities can range from misconfiguration of hosts and services to insecure application design. . Next, pentesters begin actively discovering vulnerabilities to determine how successful exploit strategies might be. Failed exploits can crash services, trigger intrusion detection alerts, and otherwise ruin the chances of a successful exploit being. At this stage, pentesters often deploy vulnerability scanners that include a Vulnerability database. However, although vulnerability scanners are powerful tools, they cannot completely replace critical thinking, accordingly, results must be reviewed manually.

=== Exploitation ===
The exploitation phase of a penetration test is exclusively about gaining access to a system or resource bypassing security constraints. If the previous phase, vulnerability assessment, has been properly conducted. This phase should be well planned and a precision strike. The main focus is to determine the main entry point into the organization and identify high-value targets.

=== Post Exploitation ===
The purpose of the post-exploitation phase is to determine the value of the compromised
computer and to retain control of the computer for later use. If an unpatched legacy system is penetrated that is not part of a domain or otherwise networked with high-level targets, and that system is not populated with information of interest to an attacker is filled. The risk of this vulnerability is significantly lower than if access to a domain controller has been proven. The value of the computer is determined by the sensitivity of the data stored on it and the usefulness of the computer for further compromise of the network. The methods described in this phase are intended to help the auditor identify and document sensitive data, determine configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and to establish one or more methods for subsequent access to the computer. For example, password hashes could be read to see if they can be used to access other systems.

=== Reporting ===
A pentester must produce a detailed report on the testing process and the vulnerabilities discovered. A penetration test report is the only tangible product of a pentest. The entire purpose of a penetration test is to identify vulnerabilities and security issues that the organization can address - and these are communicated via the report. Therefore, a penetration tester must ensure that they produce the best report possible. A good penetration test report includes a summary of the results and the approach taken, summarizes the vulnerabilities and their impact on the organization, and makes recommendations on how to fix them.

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]