Basic Expectations and Performance

Hacking is illegal and should not be performed. This presentation does not condone or approve of hacking in any way. Penetration Testing is an agreed form of audit between two parties and should be bound in writing defining the scope and nature of what is to be audited. This presentation is solely for academic and educational purposes only.

Initial planning of the audit External Scanning/Footprinting Internal Scanning Vulnerability Assessment John the Ripper usage Metasploit basics Post-audit reporting

Type of audit to assess security of a system Provides feedback to the stakeholder what their security posture is like Enumerates weaknesses and gives countermeasures/suggestions to strengthen

Penetration Test may be included in a scheduled audit or independently May be announced or unannounced Define the scope Decide who will perform the audit Conflict of interest Non-trusted party

Ensure the scope is clearly understood by both parties Understand what the auditors are capable of testing Certified? As the client negotiating, remain in control Get bids- Gives a good comparison of prices

Understand your responsibility to the client Your access/attempted access will be privileged Try to be as non-invasive as possible unless given permission Sometimes a proof-of-concept is all thats needed The client expects a report. Ensure deliverables are agreed on

Business is at stake, know when to begin Remember that this is an audit and that every activity must be documented External activity is not exempt from documentation. Keep a mindset as if you were collecting evidence Prepare your tools Run updates on your software Pack extra batteries

Planning is crucial for every step taken Plan to meet Plan for introductions Plan for the surprise attacks Plan for the unexpected Plan to introduce presence to the unsuspecting In cases of unannounced audits, special actions may need to have preparations in case caught or blown cover

Port scanning from the internet is simple Need the public IP Address for the company Run a port scanner (NMAP) with options and discover what port are open. If a known port is found, scripts are good at discovering the security state of that port. Scripts that are available online can be a huge threat since anyone can use them.

Look at traces. Provides IP Addresses to mail servers IP Addresses can lead to more destinations on the internet for scanning and profiling Down side IP Addresses can lead to web hosted services Sometimes the PTRs can lead to a host with a robust firewall as a dead end.

Web site can give good information when looking for s, executives, and technical staff. Excellent for social engineering attempts. If there are interactive web pages, further research can uncover exploitable items (XSS,web injections, or simple valid queries)

Depends on the scope and plan Performing undercover scans and testing is best done before introducing to the unsuspecting. Good time to also social engineer, test policies, and scan wireless Test policies for information control Use kismet or other wireless scanner

After presence is known, ensure the IT staff knows what type of testing will be performed, expectations of event logs, and NOT to adjust security posture during the audit.

Survey the network in any case whether you know the network diagram or are blind testing Scans include all devices on the network, their Operating System, open ports, and services running If feasible, look for open access ports to the network in discreet areas. Ideal for placing your own wireless access points

Try the low hanging fruit Check network places and shared drives for unrestricted access. Copy machines may have onboard hard drives with file sharing Users may know enough to be dangerous sharing folders

Network scanner Identifies devices and Operating Systems More quiet than pinging devices Uses the REQ,ACK,SYN for communications Returns open ports and has options for more stealthy operations on a sensitive network

Nessus Free for personal use Linux can use apt-get Windows can download Requires registration before usage openVAS Spin off of Nessus

Enumerates vulnerabilities per device Web GUI provides easy usage and real-time enumerations Works with Metasploit to provide a scan and attempt at known vulnerabilities Requires database for saving Nessus scans Use the Search in Metasploit to find modules relating to scans to begin probing

Offline password cracker Used on SAM dumps, LANMAN, most types of password hashes Can also be used to generate mangled wordlists for uses with other tools. Know the how to write rules in john.conf file Output file can be in a txt format Remember the john.pots file

Online password cracking Great for dictionary attacks (wordlists) Best if used on known open ports Wordlists can be found online and mangled with JTR for more complex

Read any precautionary comments before starting. Some exploits could cause damage to databases or resources costing your client money Try not to use clients network to do quick research, it could contaminate results Advise IT staff of certain network loading tests and log expectations Ask, when in doubt if a critical resource is discovered vulnerable, about exploiting Proof-of-concept may be all that is needed

Metasploit is an open source platform supports vulnerability research exploit development creation of custom security tools Included in BackTrack distributions Recommend intense training to master Metasploitable VM download

Known vulnerability occurs in victim Related exploit is set in Metasploit Options are configured for the victim Payloads are viewed and selected Payloads are what the attacker wishes to happen Exploit occurs causing the victim process to crash Payload is triggered

Metasploit offers much more than the scope of this presentation Fuzzing protocols like IMAP and TFTP Writing fuzzers can become the first step to creating new exploits Good for protocols on the network that have no known module Password sniffing on the wire Creating backdoors to maintain access

Check for any open activities Confer with IT staff that all network activity is normal Ensure all documentation is collected

Generate documentation of all work performed Official audit report to the client Should incorporate summaries, details, and exhibits Include screenshots and pictures taken Describe details of each action and what threat it presents

In most cases, a brief presentation to client and selected staff will be performed Include most significant threats discovered and solutions Emphasize the impact of all negative findings to the business Include positive notes where security was solid

Audit report is a confidential document to the client It is an official report that will be integrated into reports of other audits for that client Use encryption if delivering by Exercise infosec in all cases regardless of method used for communications Be thorough, use passive writing, use pictures

Instill confidence in your client and yourself Know your capabilities and limits, personally and legally Perform a thorough audit documenting as you go Sharpen and research tools Deliver solid feedback and suggestions

unleashed/Main_Page unleashed/Main_Page ml ml ml ml