2.1 - Penetration Testing Process and Types

 2.1 - Penetration testing process and types 

 

Key Terms 

• Ethical hacking – Exploiting systems to find vulnerabilities and security weaknesses to be patched. 
• Penetration test – An action of breaking into a computer system to find weaknesses. 
• Red team – An offensive team that attempts to discover vulnerabilities. 
• Blue team – A defensive team that attempts to close vulnerabilities. 
• Purple team – A mix of both teams. 

 

The Hacking Process 

Reconnaissance/footprint - the hacker gains information about a target through public data, social engineering, ‘dumpster diving’, etc... 

Scanning/enumeration - the hacker engages with the victim and uses tools to gain information about the target. This can be anything from gathering open ports on a network, extracting usernames, computer names, network resources, shares and services. 

Gain access – the hacker exploits vulnerabilities in the system found through the reconnaissance and scanning phase. This is where damage to the system is done, or data is stolen/deleted. 

Maintain access – the hacker must ensure they have access to the system however long it takes to complete the attack. They do this through installing backdoors, rootkits and trojan horse malware. Once a hacker installs these exploits, they can carry out larger and more complex attacks. 

Clear your tracks – the hacker overwrites log files and clears any other indication of a breach. This makes sure they aren’t found and prosecuted for their actions. 

 

Penetration Test Life Cycle 

Every step in the penetration test life cycle is the same except for ‘clear your tracks’. Instead, it is replaced by the reporting phase – the tester will report back the vulnerabilities they have found and show the client how to close exploits and mitigate risks of real cyber-attacks. 

 

Penetration Testing Frameworks 

• OWASP – Open Web Application Security Project. This educates people on basic web application security such as SQL injection prevention. 
• OSSTMM – Open Source Security Testing Methodology Manual. Attempts to create one method for an extensively secure security test. 
• NIST – National (USA) institute of Standards and Technology special publication 800-115 (NIST SP 800-115). A guide to the basic technical aspects of conducting security assessments. 

 

Penetration Testing Types 

• Black box – this is when the tester has no prior information about the target. It is the most effective way of simulating a real cyber-attack. The test ignores inside threats and takes a long time to complete. It is also the most expensive test to complete as a lot of time and resources are needed to go into the reconnaissance and scanning phase. 
• White box – this is when the tester is given full knowledge of the target computer system and networks. It provides a comprehensive test of the environment, however; it is not as realistic as a black box test. 
• Grey box – this simulates an insider threat. The tester is given partial information about the computer system which can be used to save time on reconnaissance and scanning the target.