1: 8 Penetration Testing and Exercises Flashcards
Goal of penetration testing
Defeat security controls
What should be done before pen-testing
Document rules and scope of testing i.e. target systems, permitted techniques
Create Rules of Engagement document
Penetration Testing - Attackers
Security Professionals
WhiteBox Test
Attacker has full knowledge of the system, simulating an internal attack
BlackBox Test
Attacker has no knowledge of the system, simulating an external attack
Graybox Attack
Attacker has some knowledge of system, commonly used.
Discovery Phase
Finding a potential path - active and passive reconnaissance to collect information
Attack Phase
Gaining access, escalating privileges, system browsing, install additional tools
Pivot
After gaining access to system, the attacker can move to more desirable systems
Persistence
Installing tools on that system to allow future access independent of initial vulnerability
Clean-Up
Removing evidence of attack once job is completed
Which phases should penetration testing attacks loop between?
Discovery and Attack
Bug Bounty
Pay money through a program for people to identify bugs in a system
Who manages bug bounties?
Usually Third Parties, but sometimes self-managed.
Cybersecurity Exercise
Identifies vulnerabilities while providing experience in defending and attacking
