In this lesson, we're going to explore
common target criteria used in pen testing.
Understanding these criteria helps you focus your efforts
on areas that are most likely
to yield significant security insights.
We'll cover running services, vulnerable encryption methods
and defensive capabilities.
First, let's discuss running services.
Services running on a system are potential entry points
for attackers.
Each service can have its own set of vulnerabilities
and misconfigurations.
For instance, a web server running Apache
may have different vulnerabilities compared
to an FTP server running on the same machine.
Identifying all running services is an important step
in penetration testing.
Tools like Nmap can be used to scan for open ports
and identify the services running on those ports.
Once identified, you should check
for known vulnerabilities associated with those services.
For example, if you find that a server
is running an outdated version of open SSH,
you can look for known exploits
or configuration issues that might be leveraged.
Next, let's talk about vulnerable encryption methods.
Encryption is designed to protect data,
but outdated or improperly implemented encryption
can be a significant vulnerability.
Common issues include using deprecated algorithms
such as MD5 or SHA-1, which are no longer considered secure
or improper key management practices.
For example, SSL and TLS protocols are intended
to secure communications.
But if a server is using an outdated version like SSL 2.0
or SSL 3.0, it is acceptable to various attacks like POODLE.
The POODLE or Padding Oracle On Downgrade Legacy Encryption
attack is an on path exploit
that targets a vulnerability in the SSL 3.0 protocol.
During a penetration test,
we need to identify all encryption methods
and use and assist their strengths.
Tools like Open SSL can help evaluate the security of SSL
and TLS implementations on web servers.
And lastly, let's consider defensive capabilities.
Defensive capabilities refer to the security measures
and organization has in place to detect
and respond to attacks.
This includes firewalls, intrusion detection
and prevention systems, and security information
and event management systems.
Understanding these capabilities
help you tailor your testing approach.
For example, if an organization has a robust IDS
and IPS setup, you might need to be more stealthy
in your reconnaissance and exploitation phases
to avoid detection, like lowering your Nmap scan speed
option to something like T2.
Additionally, testing the effectiveness
of these defenses is critical.
For instance, you could attempt
to bypass a web application firewall
to see if it correctly identifies and blocks your attacks.
Imagine if you're conducting a pen test
for a financial institution.
You begin by using Nmap to scan for running services,
and you discover a mixed up HTTP, SSH and database services.
You then find the database service
is running an outdated version, MySQL,
which has known vulnerabilities.
Moving on to encryption,
you test the institution's web application using OpenSSL
and discover that some applications
still support weak ciphers and outdated SSL versions.
Finally, you assess the organization's
defensive capabilities.
You notice that they have IDS and IPS systems in place.
To test their effectiveness,
you perform a series of stealthy scans
and control attacks
to see if they trigger alerts or get blocked.
You find that while the IDS
and IPS systems detects some of your more obvious scans,
it misses more subtle
and obfuscated scans highlighting areas for improvement.
So remember, common target criteria in penetration testing
include running services, vulnerable encryption methods,
and defensive capabilities.
Identifying and evaluating these areas allows you
to uncover critical vulnerabilities
and assess the effectiveness
of the organization's security measures.
By focusing on these criteria,
you can provide valuable insights
and recommendations to enhance the overall security posture
of the systems that you're testing.