In this lesson,
we'll discuss the thought process
behind target selection for penetration testing.
We'll focus specifically on understanding
and choosing CIDR ranges, Domains, IPs,
and URLs as targets for the test.
This selection process is foundational,
as it determines the scope
and potential success of a penetration test
by identifying the assets most vulnerable to our test.
Let's start with CIDR or classless inter-domain routing.
This is a method used to allocate IP addresses
and route internet traffic.
CIDR ranges are important in penetration testing
for defining the block of IP addresses
that are under the scope for a test.
For example, a company might own the CIDR block
192.168.100.0/24,
which includes all IP addresses
from 192.168.100.1
to 192.168.100.254.
When planning a network penetration test,
identifying this range helps testers
ensure full coverage of the network,
targeting all devices within its IP block.
This approach ensures no critical assets within that range
is overlooked during the vulnerability assessment phase.
Next, we'll discuss the domains.
Domains are human readable addresses
used to access websites on the internet,
and they play an important role
in external penetration testing.
For example, the domain diontraining.com
might serve as the primary target for testing,
as it's the main interaction point for users
and potentially a prime vector for threat actors.
We as penetration testers might assess this domain
to find vulnerabilities in its DNS configuration,
web applications, and other publicly accessible resources.
A detailed assessment could reveal security weaknesses
in subdomains like support.diontraning.com
or mail.diontraning.com.
Now, each of these
hosts different applications and services
which are critical for the company's operations.
Moving on to individual IP addresses,
which represents specific nodes or servers
within a network or on the internet.
For a penetration tester,
each IP address is a potential entry point
into the client's digital environment.
Targeting IP addresses often involves scanning them
to discover open ports and services that could be exploited.
For example, a tester might find
that the IP address 192.168.100.50
hosts a database server with outdated software.
Suppose the tester discovers that the target database server
is running mySQL version 8.0.15.
By searching through the national vulnerability database,
the tester identifies a critical CVE,
CVE-2023-40692
linked to this version.
This vulnerability allows an unauthenticated attacker
to run arbitrary SQL commands on that server.
This can enable the attacker to access
or alter sensitive data or even delete it,
posing a significant threat
to the integrity and confidentiality of that database.
So this example shows how finding an outdated server
can lead to identifying significant vulnerabilities
just by searching the public web for known issues.
URLs or Uniform Resource Locators
point to specific resources on the internet
or an internal network,
often directing traffic to a particular page or service
within a domain.
In a pentest, URLs are typically more relevant
when testing specific web applications.
For example, the URL diontraining.com/login
directs to a login page,
which could be tested for vulnerabilities
like SQL injections or cross-site scripting.
A detailed example might involve a test
to discovering that appending a SQL command to the URL
could manipulate the backend database security,
potentially revealing user credentials or personal data.
For instance, a test might modify the URL
diontraining.com/login?username=admin'--&password=.
Now this SQL command appends
to the URL username=admin'--.
it's an attempt to bypass the login process
by injecting a comment, --,
after the admin username,
potentially tricking the backend database
into ignoring the password check.
If the web application is vulnerable,
this could allow the tester to gain unauthorized access
to the system, revealing user credentials or personal data.
So remember, the selection of CIDR ranges, Domains, IPs,
and URLs as targets is a critical first step
in the penetration testing process.
It defines the scope of the test
and focuses on the tester's efforts
on the areas most susceptible to an attack.
Understanding the interplay between these elements
and their vulnerabilities
allows testers to effectively plan and execute these tests,
ensuring a comprehensive security assessment.
Now, this meticulous approach
not only identifies vulnerabilities, but also again,
helps prioritize them based on potential business impacts,
guiding effective remediation strategies in the future.