Skip to content

Latest commit

 

History

History
14 lines (8 loc) · 5.86 KB

blog22.md

File metadata and controls

14 lines (8 loc) · 5.86 KB

Blog Twenty Two: The Principles of Penetration Testing

Image

What is penetration testing?

The different methods of performing penetration testing depend on the method you choose. There are a lot of standards out there. We'll cover a few of these so you can figure out which one will best suit your needs. Let's start with the OSSTMM, the acronym for Open Source SecurityTesting Methodology Manual. This standard set of penetration tests tries to achieve a high security matrix.There is another one called OWASP which stands for Open WebApplication Security Project. OWASP is an open source method that has numerous tools that can be of great help and a knowledge base, as well as a tool called ZAPP or Zed Attack Proxy Project. ZAPP is a tool with which you can automatically find vulnerabilities in web applications. ZAPP is designed for web developers, but pen testers can also use this tool.There is also another framework called ISSAF, the Information System Security Assessment Framework. ISSAF is also an open source project for performing a penetration test. ISSAF is supported by a group called the Public Information Systems Security Group. This is called NIST, which stands for National Institute of Standards and Technology. When it comes to NIST, you should know that the federal technology agency works with industryDevelopment and application of technologies, measures and standards. We also have LPT, which stands for EC-Councils License PenetrationTester. This is a proprietary method and there is another one from McAfee called Foundstone and we also have ISS, IBM. When it comes to IBM, they run your tests for you. They also had a function-based product called Proventia that is now being discontinued.It was a multifunctional security appliance and offered many different services for protecting or testing your network environment. The same applies to McAfee and Foundstone. Technically owned by Intel. With EC councils, LPT requires the auditor to follow many different steps, similar to CEHs.

Managing a pentest

These methods also ensure that you cover social engineering pentests. These types of experiments can be done with human methods or social engineering with computers to get someone to open an email attachment. Applying pencil tests. Backend- or code-related vulnerabilities are searched for. One of the more well-known tests is most likely the SQL pencil test. SQL injection is still dominant today. Use non-validated input variables that are passed via SQL commands over the webApplication that runs in the backend database. Depending on where you place your routers on your network and switches, they will route packets of data from one point to another, sometimes inside and sometimes outside your system. Remove anyone who is connected to the internet. When testing routers, you can usually do so both from the internet and from within. You also need to look at the wireless network.Focus on the availability of external wireless networks that corporate employees can access. This technically bypasses the corporate firewall as the wireless technology cannot be restricted and is turned off anywhere in the air and we cannot see it and the signal can be accessed from outside the physical boundaries of the corporate location. You will also look at the strength of the encryption and the type of encryption that is being implemented. You'll continue to cover your basics with these methods by running a denial of service test.See if you can shut down your corporate network or an ecommerce website by flooding them with packages or so much traffic that you don't know what to do. If you are conducting a denial of service attack, look for the threshold at which the system will fail. You have to think about how you would deal with the stolen machines. For example, if you've locked all of your phones and laptops, then you also need to think about what happens if those computers are stolen.

Further elaborating on a pentest

For example, the penetration test team may attempt to use mobile devices and perform offline tests to access the information stored on these computers offline. For example, instead of tracking someone in the sales department's computer, you should try to target your attack on someone you have identified as an IT person. If you can recruit someone from IT or senior management, they will have more privileges or access to more systems than the rest of the workforce. You also need to look at the source code penetration tests.Many companies these days use in-house applications, and sometimes those applications are not even considered part of the security platform. As a pen tester, you can view the source code manually or there are numerous tools that can help you. In this type of testing, the testing team tries to access the facility before, during, and after business hours, but is not allowed to take any destructive action. For example, windows aren't broken, but if you can choose to easily bolt the door, disassemble the door, or jump the turnstile, you're fine with manySome companies are a little scared of doing this type of test. You will also need to run walkthroughs to provide the organization with an objective perspective of the security controls currently in place and how they are bypassed. Check if the company has cameras. If so, you would like to know if they work with a web interface. What are your points of view?For example, you can fly a drone into an area to look at the top of the camera and look behind the camera without being detected. In short, you can see how much movement is allowed before the camera is triggered, or where the visibility is. You also need to make sure that you check the databases. Here you are trying to access the data contained in the database directly by trying to use some password cracking methods.