2. Before We Start
My Introduction.
Audience Type.
Expectations from this presentation.
Disclaimer.
Not a professional Tester
Based on my learning, Understanding.
3. Agenda
Background.
What is Penetration Testing.
Need for Penetration Testing.
Methods and Techniques of Pen Test.
Demo.
Tiger tools.
MetaSploit.
ExploitTree
Whopix.
ERD Commander(local Password Craking).
Questions.
Resources.
4. Background
What is Penetration Testing
A form of stress testing, which exposes weaknesses or flaws
in a computer system.
Art of finding an open door.
A valued assurance assessment tool.
PT can be used to find Flaws in
Policies
Specifications
Architecture,
Implementation,
Software,
Hardware,
And many more………………
5. Background
Need for Penetration Testing
To find poorly configured machines.
Verify that security mechanisms are working.
Help organizations to tighten the Security system.
FACT!!!!
99.9% secure = 100%vulnerable!
6. Methods and Techniques of Pen Test.
Black Box
zero-knowledge testing
Tester need to acquire the knowledge and penetrate.
Acquire knowledge using tools or Social Engineering
techniques
Publicly available information may be given to the penetration
tester,
Benefits:
Black box testing is intended to closely replicate the attack made
by an outsider without any information of the system. This kind of
testing will give an insight of the robustness of the security when
under attack by script kiddies
7. Methods and Techniques of Pen Test.
White Box
complete-knowledge testing
Testers are given full information about the target system they are
supposed to attack .
Information includes ,
Technology overviews,
Data flow diagrams
Code snippets
More…..
Benefits:
reveals more vulnerabilities and may be faster.
compared to replicate an attack from a criminal hacker that
knows the company infrastructure very well. This hacker may be
an employee of the company itself, doing an internal attack
8. Methods and Techniques of Pen Test.
Gray-box or crystal-box test
The tester simulates an inside employee. The tester is given an
account on the internal network and standard access to the network.
This test assesses internal threats from employees within the
company.
9. Methodology of Penetration Testing.
There are NO formal methods of Penetration testing!!!!!!!!
Typically has Seven Stages
Scope/Goal Definition
Information Gathering
Vulnerability Detection
Information Analysis and Planning.
Attack& Penetration/Privilege Escalation.
Result Analysis & Reporting.
Cleanup.
REPEAT
10. Methodology of Penetration Testing.
STAGE 1: Scope/Goal Definition
Which attacker profile the tester will use
Hacker with no knowledge about the target.
Hacker with knowledge about the target.
Internal user with access.
Which systems or networks the test will be conducted.
How long will the test last.
11. Methodology of Penetration Testing.
STAGE 2: Information Gathering.
Information about the Targets.
Publicly available information( WWW.Arin.net, nslookup)
Technical Information provided by organisation.
12. Methodology of Penetration Testing.
STAGE 3: Vulnerability Detection.
Manual Detection
manually probe the target host for common misconfigurations or
flaws because a vulnerability scanner can fail to identify certain
vulnerabilities.
Ex: database configurations etc….
Using Software.
Use of commercial or Freeware Scanners to enumerate known
flaws or vulnerabilities , Ex: Retina ,Hfnectcheck, GFI
Languard, Nikito, nmap so on.
PLENTY TOOLS available in Market/Internet.
13. Methodology of Penetration Testing.
STAGE 4: Information Analysis and Planning.
Collating the information gathered in previous stages.
Preparation of High level attack planning
Overall Approach
Target identification.
14. Methodology of Penetration Testing.
STAGE 5: Attack & Penetration/Privilege Escalation.
Has Two Sub Stages
I. Attack & Penetration
Known/available exploit selection
Tester acquires publicly available s/w for exploiting.
Exploit customization
Customize exploit s/w program to work as desired.
Exploit development
Develop own exploit if no exploit program available.
Exploit testing
Exploit must be tested before formal Test to avoid damage.
Attack.
Use of exploit to again unauthorized access to target
15. Methodology of Penetration Testing.
STAGE 5: Attack & Penetration/Privilege Escalation.
II. Privilege Escalation
What can be done with acquired access/privileges.
Alter.
Damage.
What not ……
Repeat the Stages (2 to 5)
16. Methodology of Penetration Testing.
STAGE 6:Result Analysis & Reporting
Organize Data/related results for Management Reporting.
Consolidation of Information gathered.
Analysis and Extraction of General conclusions.
Recommendations.
17. Methodology of Penetration Testing.
STAGE 7:Cleanup
Cleaning of all that has been done during the testing
Any System alterations
Exploits