- In this lesson 27.3,
we're gonna continue talking about penetration testing
with a focus on tools and techniques.
Now, penetration test is designed to exploit
either actual or proof of concept weaknesses
in a target environment.
Then not to be confused with a vulnerability scan
which looks for known vulnerabilities
in the target environment
and reports on potential exposures.
So let's look at the phases of a penetration test.
It's gonna start with passive reconnaissance,
followed by active reconnaissance,
then the exploitation.
Additional research might come from the exploitation,
continued exploitation, and then finally, reporting out.
Now we're gonna look at these penetration test phases
individually from the perspective of an ethical hacker,
but really everything we're talking about here until
we get to reporting with the same thing
that our adversaries or our attackers would do
when they're trying to find ways to get
into our environment or exploit our environment.
So passive, active exploitation, additional research,
continued exploitation and reporting.
So let's start with the very first step,
reconnaissance, which is also known as footprinting.
There are two types of reconnaissance,
we have passive reconnaissance and active reconnaissance.
Passive reconnaissance is information gathering
using publicly available resources,
the target of the reconnaissance has no knowledge
of the activity 'cause there's no interaction
with any of the target systems.
So an example might be going to who is for IP addresses
or looking at LinkedIn or Facebook for external relationship
or people or personal information or content of interest.
Do they have a website?
Do they have email?
Does it look like they have a remote access portal?
Active reconnaissance is using technical tools
could be automated and or manual
to really probe and discover information.
Now, active recon can be intrusive
and may very well be discovered.
So examples are looking for things like network connections,
open ports, enumeration of users and groups
and services and maybe what type of browser
you have and applications.
And then trying to identify the vulnerabilities
that are associated with those.
Let me give you some examples of passive
reconnaissance sources,
search engines, social media, domain registration
DNS reconnaissance, public databases, web scraping,
OSINT, and AI Chatbots.
So we can use search engines such as Google
and Bing and Showdown.
We can use social media, right?
Monitoring and analyzing social media platforms.
We can use a who is database or the who is lookup tables
for IP addresses and domain registrations.
We can use a number of tools
for DNS reconnaissance, like DNS recon or Fierce,
and which can perform passive DNS information gathering.
We can use public databases such as databases of breaches,
previous breaches or vulnerability databases.
And do web scraping tools like Netcraft
can be used to identify a website server and client side
operating systems and software.
If you haven't used Netcraft before,
go try it out, it's really a lot of fun.
You can use OSINT tools, open source intelligence tools
like Recon NG, which can automate the collection
and analysis of various publicly available data sources.
And an emerging source is using our AI chat boxes.
Again, this is all gathering information right
about the organization, right?
Without actually interacting.
Why is passive reconnaissance?
And then, and we're gonna talk about
active as well in just a moment so important,
because gathering all that information
is what the pen testers will do to design and craft
their exploits, and you know,
in an attack scenario, it's all the information
our attackers would use to craft their attack.
So let's look at some active recon tools,
NMap and Nessus, Megagoofil and Burp Suite.
And if you have a home lab,
you should be trying all of these out.
Nmap we use for port scanning and network discovery,
Nessus for vulnerability scanning and enumeration,
Metgoofil for extracting metadata,
remember that's data about data of public documents,
and Burp Suite for website vulnerability scanning.
Now exploitation is the stage where the testers
exploit target systems to compromise them.
Now there are two approaches, one is compromise exploitation
and the other is proof of concept exploitation.
You wanna be very clear in your ROE, which one you're doing.
So compromise exploitation is the process
of fully exploiting the vulnerability
without regard to potential damage.
Now, what could happen?
Well, we could have a system crash denial of service,
we could end up with corruption
or we could end up with exfiltration
of sensitive, confidential or regulatory protected data.
Now, proof of concept exploitation
is the process of providing just enough evidence
that the vulnerability is exploitable.
Could be a screenshot or a snippet out of a log
or a piece of code.
Once again, those exploitation expectations
should be agreed upon and documented
in your rules of engagement document.
Let's look at some common exploitation techniques.
These are common techniques that are used
by both our testers and by our adversaries.
Pivoting is the act of using a weakness
on one system to access a better protected system.
It's usually really difficult to be able to
get right into a better protected system, right?
Because well, you've got lots of controls, right?
Defense and depth, you're better protecting it.
But there are gonna be lots of systems
in an environment that people don't really care about.
Maybe it's a training server
maybe it's an old archive server,
maybe it's an old server still running
like Windows seven,
we haven't used for a long time but once in a while, right?
Someone might need to access it.
So it's sit in a corner somewhere and we, you know
get to it when we need it.
So pivoting being the act of finding those weaknesses
on systems and using that weak systems
to pivot to access a better protected system.
Escalation of privilege is the act
of exploiting a vulnerability
to gain elevated access to a resource.
And that's really elevated,
we mean that, you know
it's not just what a user could normally do,
it's more access than the user or even an application
would have more access to that resource.
Persistence is the active installing or modifying services
or installing malware or creating back doors
or creating accounts that will survive reboots,
that's why it's called persistence,
you could reboot your system
and reboot your system and it's still gonna be there.
Very popular Exploitation tool is Metasploit,
so again, if you have a home lab
you may wanna play around with Metasploit.
Now exploitation can be manual or it can be automated
and it can be just kind of off the shelf
or it can be customized.
And certainly our best penetration testers,
you know, are going to use a whole array
of automated techniques.
But they're also gonna craft some really, really
strategically targeted exploits.
And then we get to reporting,
penetration test reports should include
vulnerability findings,
exploit activities, and recommendations for mitigation.
Vulnerability findings should be categorized
and referenced appropriately with the CBE notation.
The exploit activities, including proof of concept,
should be documented with enough details
so they're reproducible.
So after we re remediate, we can say,
okay, is that problem that issue
with that vulnerability still there?
Now mitigation recommendations should be prioritized
and as applicable should include risk reduction
and security enhancement recommendations.
And that my friends, brings us to a three second challenge.
Five challenge questions, three seconds each.
You know what to do.
Information gathering using publicly available resources.
1, 2, 3, it's gonna be passive reconnaissance.
Number two, active using a weakness on one system
to access a better protected system.
What's that called?
1, 2, 3.
It's gonna be pivoting.
Number three, the act of explaining of vulnerability
to gain elevated access to a resource.
1, 2, 3.
That's gonna be escalation of privilege.
Number four document that
authorizes your exploitation approach.
1, 2, 3.
That is your ROE or your rules of engagement.
And lastly, number five,
providing evidence that a vulnerability is exploitable.
1, 2, 3.
And that's gonna be POC or proof of concept.
All right, let's do a security in action.
This is about a regulatory recommendation.
Your organization's regulatory agency
has recommended that the next penetration test
allow for compromise exploitation.
Management's really puzzled by this and you've been tasked
with explaining what it is and the pros and cons.
So what are you gonna tell them?
Kind of an odd request from a regulatory agency
but we have a regulatory agency
who said this is what we want you to do.
So more than likely, it's what you're going to do, right?
They're saying that it should be a compromise exploitation
and management's pretty puzzled and said what is this?
And they turn to you and say
can you tell us the pros and cons?
So go ahead and put me on pause for a second.
Jot down what you think the pros
and cons are of compromise exploitation.
Well, compromise exploitation is an aggressive
form of testing that involves exploiting
discovered vulnerabilities to gain
unauthorized access or control.
So what are the pros?
Well, it provides a really detailed understanding
of potential damage,
and it does simulate a real world attack.
Because we know that our attackers aren't gonna just say,
hey I'm gonna give you proof of concept, right?
They're gonna go for the jugular.
But what are the cons?
Which may outweigh the pros.
It's much riskier as it involves exploiting vulnerabilities
to its full extent.
And it could potentially cause disruption,
damage, and exfiltration of sensitive
or maybe regulatory protected data.
So before I went off and said,
okay, let's just do this compromise exploitation
penetration test I'd probably wanna have another chat
with my regulatory agency.
Make sure that's really what they want
and get a better understanding
of why they want it doing all that.
That my friend is security in action.
There's your word cloud.
I know you know what to do with it.
Soon as you're ready, come on over,
I got a quiz waiting for you.