To be effective at information gathering
and identifying possible vulnerabilities,
a penetration tester needs to keep up to date
with the latest techniques and vulnerabilities
because, as you know, vulnerabilities frequently change.
We always need to keep on top of this.
Every time there's a new security breach,
we are provided with the opportunity
to add a new tool to our penetration testing arsenal.
There is a lot of different sources available,
and it's not my goal here
to provide you with an exhaustive list.
Instead, I'm going to try to focus on a few places
that you should recognize,
and more specifically,
a few types of information
that are called up by the exam objectives,
such as CVEs and CWEs.
Please realize though,
there are many more options available out in the real world,
including security blogs, podcasts, and others.
The website you should know about first
is the Computer Emergency Response Team or CERT.
This is located at cisa.gov/uscert.
This website is maintained
by the United States Federal Government,
and it lists all the different known vulnerabilities
that have been identified in the wild,
as well as those that are self-reported
by industry partners.
For example, we could click on an article
titled "CISA Releases Advisory on Destructive Malware
Targeting Organizations in Ukraine"
to find out all about the recommendations and strategies
to prepare for and respond to destructive malware,
or perhaps, "CISA will also have added
Four New Vulnerabilities
to its Known Exploited Vulnerabilities Catalog,"
and you could review those as well.
JPCERT is our next website.
JPCERT is Japan's version
of the Computer Emergency Response Team,
and it contains similar alerts in advisories
about what viruses are on the rise
according to their internet threat monitoring.
Their website is located at jpcert.or.jp,
and they do have an English version of that as well.
Another great resource is known as the NVD
or National Vulnerability Database.
The National Vulnerability Database is provided
by the National Institute of Standards and Technology
known as NIST.
This US focus site is located at nvd.nist.gov.
And the webpage displays all the latest vulnerabilities
and assign each of them a CVE number.
For example, there may be a CVE called
CVE-2022-123.
This means it's the 123rd vulnerability
that was identified during the calendar year of 2022.
Each CVE also has a score associated
with how dangerous it is,
listed as either critical, high, medium, or low severity.
Generally, when conducting a penetration test,
I focus the majority of my efforts
on finding and exploiting the critical
and high vulnerabilities in my target networks.
As you might imagine,
there are lots of vulnerabilities
and new ones are coming out all of the time.
But don't worry,
it isn't necessary to memorize
every single vulnerability out there.
However, you do need to know where to look
because if I identify a target server
is running Apache 2.2.2.6 for instance,
I can then go and see if there's any vulnerabilities
associated with that particular version of Apache.
This can then lead me to an exploit,
which can provide me a way
to enter into that victim's network as a penetration tester.
Now, you may be wondering,
what exactly is a CVE,
and why does the NIST website use them
to reference these different vulnerabilities?
Well, the acronym CVE
stands for the Common Vulnerabilities and Exposures,
and there is a compilation of them located at cve.org.
This common database is used worldwide,
and every single vendor
submits their known vulnerabilities to the CVE database:
Microsoft, VMware, Norton, and all of the others.
Anytime there's an issue found
with their hardware or software,
they submit it into the CVE database,
which means this is a great place for us to look
when we're doing our open source intelligence
and research efforts.
Another great source of information
is the Common Weakness Enumeration or CWE,
which is located at
cwe.mitre.org.
This is a community developed list
of all the different types of software weaknesses
and the details for those weaknesses.
Now, these aren't necessarily vulnerabilities
like the ones listed as CVEs,
which are more focused
on a particular software product and version.
Instead, these are common vulnerabilities
across all types of software.
Therefore, as a software coder
or somebody who's conducting penetration testing
for software,
you should be familiar with and look at the community list
as it's continually being updated and expanded.
Another thing you should look at is CAPEC,
which is the Common Attack Pattern
Enumeration and Classification,
which is located at
capec.mitre.org
This website exists to help us understand
and identify a particular attack
so that security researchers can better understand
the different attack patterns.
As of February 2022,
there were 546 distinct attack patterns
that are used by various threat actors around the globe.
This is useful for penetration testers to learn
because these are attack patterns
that we could be using during a penetration test,
or we could be asked to emulate during a red team exercise.
For example, if we find a particular threat actor
often uses a particular attack pattern,
we could then emulate that as part of our red teaming,
and CAPEC is an incredibly useful tool
from that perspective.
Another option for us is known as Full Disclosure,
which is a mailing list from the makers of Nmap.
As you're soon going to learn,
Nmap is a crucial tool for our scanning,
enumeration and fingerprinting efforts.
Nmap's Full Disclosure list can be read online,
receive via email, or push to your favorite RSS reader,
making it a great way to keep up to date
with the latest cybersecurity threats and breakthroughs.
Now, I know that was a lot of different websites
that I just threw out at you.
On exam day,
you're not going to get asked about a specific website,
but you are expected to understand key terms
like CVEs and CWEs
and how they could be used to link a vulnerability
to a potential exploit.
In fact, when you start using
some exploitation framework tools like Metasploit,
they actually link their exploits to the CVE numbers
to make things even easier for you.
When you run a vulnerability scan against a target,
which happens in the vulnerability
scanning part of our engagements,
those tools will also report the vulnerabilities
in terms of CVEs, too, most of the time,
making it really easy for you to identify
and then link them to an exploit as a penetration tester.