In this demonstration,
we're going to walk through a penetration testing report
to help you understand the components
that make up a penetration test.
Now, we'll be referencing the report
prepared by PrimoConnect.
It's going to go over a company called SampleCorp Ltd.,
but this is indicative of a real penetration testing report.
It's going to have all the parts that we need,
but it's also going to show CompTIA
lays their particular components of report out differently
than a lot of companies,
but they're all encompassed in the same report.
So, the whole purpose is for you to really see
how it looks in real life
and just understand what is a part of each component.
So the first thing we want to do is scroll down here,
and we want to look at the Executive Summary.
Summary, all right, perfect.
So we know that the executive summary
is the high-level overview of the penetration test,
so it's going to summarize the purpose, the scope,
major findings of the test.
Here, the report highlights that multiple critical
and high-severity vulnerabilities were identified, right.
So again, this is just going to give us a general overview
and letting know
all the different environment statistic.
This is for executives,
these are people that are making decisions,
but they're not very technical in nature, right
so we need to give a high-level overview, let them know,
'hey, look, big words like critical, low, high,' right?
things can be easily categorized
so they know which more important, what's less important,
and just give them the general names
of the testing environment.
But here, typically, you might see recommendations
at the end of a report, but it makes sense here,
because this is for the executives
who's actually making the decisions,
so one that's sending the check, right?
So the recommendations should be right next
to the executive summary.
So if you look through,
it gets a little bit more specific information
about the vulnerabilities that need to be corrected, right
so let's look at number one.
So ensure that the credentials protecting
the GlassFish instance on host
172.16.2.8
are of suitable complexity to prevent brute-force attacks,
or disable secure admin on the instance
to prevent remote access to the DAS, right
so this is going to be defined somewhere in here
as far as this acronym.
But again, you see, it's just given a good example,
being very specific and letting you know
why you need to do this, right.
So pretty much, it's probably going to be something more
of increasing your password complexity, right?
'cause it might have some type of weak passwords,
or maybe even using multi-factor authentication here,
and then so we have another one.
Let's look at number three, for example.
Require authentication to use the webDAV functionality
on host 172.16.2.8, so pretty much,
there is no authentication.
so that means that's going to be easy
for any type of attacker
to kind of go through if they gain access
to this particular network.
Now, if you look at this network, you see it's 172.16.2.8,
meaning it's a private network,
so once they get to the private network,
then it's going to be an issue with logging onto this.
So typically,
if you see a traditional critical vulnerability
and it's a system where, hey,
we're worried about IP addresses
that's on a private network,
typically, they're behind a VPN, so they're usually less,
because when they do the CVSS scores,
they assume the worst.
So, I've dealt with this many times.
Some of the companies I work for, going through
and actually having to tailor the particular criticalities
to our environment, and a lot of environments
are behind the VPN, which requires authentication,
and a lot of times, it requires specific laptops
and specific locations so sometimes, they're geofenced.
All right, so let's go on next.
Let's try look up the methodology,
so let's go back to the top, see if they have anything here.
The one thing I realized about this report
is that a lot of times, they input the methodology
within some of the actual findings,
but they also have it here in the testing approach.
Right, so all testing was executed in several related phases
so this is kind of traditional of any penetration test,
right, so we have the planning, discovery, attack,
and then we have the reporting.
Now, here, CompTIA breaks this down a little differently.
With CompTIA, they typically have a post-exploitation phase
where they start doing things like lateral movement
and exfiltrating data, but with this particular company,
they included it all in the attack phase.
So, again, that's just letting you know that hey, look,
there's so many ways to do this,
but they all are very similar.
They don't have to be very specific.
CompTIA is very vendor neutral to include
all the different methodologies from different companies.
So we gain access to the system or environment
in a way that was not intended,
escalated privileges to move from regular
or anonymous users to a more privileged position,
and browse to explore the newly accessed environment
and identify useful assets and data,
deploy tools to attack further
from the newly gained vantage points,
and then we exfiltrated data.
So next thing we want to look at is the detailed findings.
Now, with this particular report, it's broken down
by internal networks, web applications, mobile applications,
wireless networks, and social engineering,
so we're just going to look at the first one
with the internal network findings,
and so this is where they get very specific.
So they're talking about this result classification, right
Now, the vulnerabilities found, yes. Exploited DoS, no.
Typically, this is out of scope.
Elevated privileges, remote code execution, et cetera,
and it's specific letting us know what type of protocol
that was used, what type of port, what service was running,
and what version of that software was running.
And now we're going down a little bit more specifically,
so we're getting to the specific vulnerabilities,
and they're saying, what are the recommendations
to fix those vulnerabilities?
So again, this where get very specific
so the technical people
that are implementing these solutions
know exactly what to do, so this is the detailed findings.
Now, as we go through,
this is going to be more of our attack narrative, right.
It's going to let us know exactly what's happening.
This is where we're going to get the screenshots,
so for example, the observation here,
but using the auxiliary scanner, HTTP GlassFish login,
Metasploit module, right.
We attempted to either bypass the authentication controls
protecting a GlassFish instance
or brute-force the login credentials.
Our attempt at authentication bypass failed,
but we did successfully brute-force
the administrative credentials to the instance,
the attack narrative.
How did we go from A to B? What was our method?
And here is proof of what we did.
So pretty much they're trying, trying, trying.
They see the Meterpreter.
When you get the Meterpreter,
that means you've successfully exploited the system,
and now you're running advanced processes here,
and then once you have the shell created,
and now it says that, hey, look, who am I?
The NT authority local system,
that's always typically indicative
of getting a reverse TCP shell on the external host.
All right, so that breaks down everything.
It was a little bit out of order.
Typically, you know, we're thinking about executive summary,
methodology, detailed findings, attack narrative,
and recommendations, but here in this report,
we see the recommendations are at the top,
which I like this approach, 'cause it makes more sense,
because again, the stakeholders,
the people that are making decisions,
they're going to be reading this area,
and they need to know exactly what to do fairly quickly.
I hope you enjoyed this demonstration,
and I'll see you in the next one.