1 Planning & scoping Flashcards
Why is the penetration testers teams and the owner of the system that will be pentested need to discuss?
They need to agree on the scope of the penetration testing agreement and will determine the course the penetration test takes
What is White Hat?
These hackers are considered the “good people”. They remain within the law and use their skills to benefit others. For example, a penetration tester performing an authorised engagement on a company.
What is Grey Hat?
These people use their skills to benefit others often; however, they do not respect/follow the law or ethical standards at all times. For example, someone taking down a scamming site.
What is Black Hat?
These people are criminals and often seek to damage organisations or gain some form of financial benefit at the cost of others. For example, ransomware authors infect devices with malicious code and hold data for ransom
What is the Rules of Engagement (ROE)?
The ROE is a document that is created at the initial stages of a penetration testing engagement and consists of three main sections, which are ultimately responsible for deciding how the engagement is carried out.
What are the 3 sections of a ROE and explain each of them:
- Permission: This section of the document gives explicit permission for the engagement to be carried out. This permission is essential to legally protect individuals and organisations for the activities they carry out.
- Test Scope: This section of the document will annotate specific targets to which the engagement should apply. For example, the penetration test may only apply to certain servers or applications but not the entire network.
- Rules: The rules section will define exactly the techniques that are permitted during the engagement. For example, the rules may specifically state that techniques such as phishing attacks are prohibited, but MITM (Man-in-the-Middle) attacks are okay.
Name the 5 steps of the pentesting methodology:
1/ Information Gathering
2/ Enumeration/Scanning
3/ Exploitation
4/ Privilege Escalation
5/ Post-exploitation
Explain the Information Gathering phase in the pentesting methodology:
This stage involves collecting as much publicly accessible information about a target/organization as possible, for example, OSINT and research.
Explain the Enumeration/Scanning phase in the pentesting methodology:
This stage involves discovering applications and services running on the systems. For example, finding a web server that may be potentially vulnerable.
Explain the Exploitation phase in the pentesting methodology:
This stage involves leveraging vulnerabilities discovered on a system or application. This stage can involve the use of public exploits or exploiting application logic.
Explain the Privilege Escalation phase in the pentesting methodology, explain horizontal and vertical privilege escalation:
Once you have successfully exploited a system or application (known as a foothold), this stage is the attempt to expand your access to a system. You can escalate horizontally and vertically, where horizontally is accessing another account of the same permission group (i.e. another user), whereas vertically is that of another permission group (i.e. an administrator).
Explain the Post-Exploitation phase in the pentesting methodology and what can you do during this phase (4)
This stage involves a few sub-stages:
1. What other hosts can be targeted (pivoting)
2. What additional information can we gather from the host now that we are a privileged user
3. Covering your tracks
4. Reporting
What is the OSSTMM?
The Open Source Security Testing Methodology Manual provides a detailed framework of testing strategies for systems, software, applications, communications and the human aspect of cybersecurity. It includes methodology for:
- Telecommunications (phones, VoIP, etc.)
- Wired Networks
- Wireless communications
What is OWASP?
The “Open Web Application Security Project” framework is a community-driven and frequently updated framework used solely to test the security of web applications and services.
What is the NIST Cybersecurity Framework 1.1?
The NIST Cybersecurity Framework is a popular framework used to improve an organisations cybersecurity standards and manage the risk of cyber threats.
