In this lesson,
we're going to cover the process of documenting an attack.
Proper documentation is essential for conveying
your findings clearly and effectively to stakeholders.
We will focus on three key areas,
documenting the attack path, creating low-level diagrams,
and constructing a storyboard.
First, let's begin with documenting the attack path.
The attack path is a detailed record of steps that you took
to exploit vulnerabilities
and achieve your objectives during the penetration test.
This includes every action from initial reconnaissance
to the final exploitation.
Documenting attack path helps provide a clear narrative
of how you move through the system, the methods you use,
and the vulnerabilities that you exploited.
Now, this documentation should be detailed enough
that another tester could replicate your steps if necessary.
This is especially important if you are participating
in a bug bounty program.
Since your payment depends on the company being able
to replicate the exploit or detect a vulnerability.
For example, if you are conducting a penetration test
on a company's internal network,
you might start by performing network reconnaissance
with Nmap to identify active hosts and services.
You document that you find an open port running
an outdated version of SMB,
which you then exploit using a known vulnerability
such as Eternal Blue.
You continue by detailing how you escalated privileges
on a compromised host
and moved laterally to other systems.
Each step, command used, and result
should be meticulously recorded
to ensure a complete attack path documentation.
Next, let's discuss low level diagram creation.
Low level diagrams visually represent the technical details
of an attack, showing the network layout,
exploitive vulnerabilities, and the flow of your action.
These diagrams help stakeholders understand the attack
without needing to interpret extensive technical text.
To create a low level diagram,
you can use tools like Microsoft Visio, Draw.io,
or even hand-drawn sketches that are later digitized.
Your diagram should include key elements
such as network segments, devices, services,
and the points of exploitation.
For instance, you might depict the networks topology,
highlight the compromised host
and show how you moved from one device to another.
Visual elements like arrows can indicate the direction
of your attacks and data flow.
Lastly, let's cover constructing a storyboard.
A storyboard provides a high level step-by-step
visual representation of the attack,
much like a comic strip.
It combines screenshots, diagrams and brief description
to illustrate the attack sequence in a way
that is easy to follow.
Storyboards are particularly useful for presenting
to non-technical stakeholders
who need to understand the impact
of the vulnerabilities without delving
into the technical details.
When creating a storyboard,
start with screenshots from each significant step
of your attack,
such as the initial scan results, exploitation attempts,
and successful access points.
Combine these images with short captions
explaining what each screenshot shows
and why it's important.
For example, a storyboard panel might include a screenshot
of a successful login using stolen credentials
with a caption explaining how you obtained those credentials
and the implications of this access.
To illustrate this concept a little bit further,
imagine that you're documenting a penetration test
on a company's e-commerce platform.
Your attack path documentation
starts with the initial recon using Burp Suite,
where you identify a SQL injection vulnerability
on a login page located at
IP address 192.168.1.10/login.
And during the reconnaissance phase,
you discover that the login form is susceptible
to SQL injection attacks
because of the lack of input sanitization.
You begin by testing basic payloads
and find success with a common SQL injection code
' OR '1'='1
which allows you to bypass the authentication.
After confirming the vulnerability,
you craft more sophisticated payloads
to extract database information.
For example, using the payload
'union select username,
password from users dash dash,
you retrieve a list of usernames
and hash passwords from the user's table.
Documenting each payload with a specific data retrieve
you uncover that the database is a MySQL database
version 5.7.
Next, you then retrieve credentials to escalate privileges.
You manage to log in as an administrator
gaining access to the admin panel
of the e-commerce platform.
This access allows you to map out
the internal network layout.
You identify the vulnerable server
at 192.168.1.20
and the flow of your SQL injection attack
leading to the extraction of sensitive customer data.
You then create a low level diagram
showing the network layout,
including the vulnerable server at 192.168.1.20,
the flow of your SQL injection attack
and the subsequent data extraction process.
This diagram helps visualize the attack path
and the data flow from the initial SQL injection point
to the sensitive customer data extraction.
Finally, you constructed a storyboard
with detailed screenshots.
This includes the login page at 192.168.1.10
and the SQL injection payload,
which is the ' OR '1='1
and the resulting database dump showing the extracted
usernames and passwords.
Each screenshot is accompanied by concise explanations
of each system, providing clear documentation
of the penetration test process from reconnaissance
to data extraction.
So remember, documenting an attack
involves detailed recording of the attack path,
creating low level diagrams
and constructing a storyboard.
These documentation methods ensure
that your findings are clear, comprehensive,
and accessible for both technical
and non-technical stakeholders.
Proper documentation not only demonstrates
the effectiveness of your penetration testing,
but also provides valuable insights
that could guide remediation efforts
and enhance overall security.