1.8 Explain the techniques used in Penetration Testing

Question 1

Explain Penetration Testing

Answer 1

You are actively trying to gain access into a system. This is supposed to simulate an attack that would be done by an attacker that is external to your organization. Usually a third-party will conduct these tests on a regular basis.

Question 2

Explain Penetration Testing in a known environment

Answer 2

There is full disclosure on the systems given to the pentester, especially if you are performing a test on yourself.

Question 3

Explain Penetration Testing in an unknown environment

Answer 3

A pentester knows nothing about the systems under attack. They will have to build out a database of information as they go. This is a blind test.

Question 4

Explain Penetration Testing in a partially known environment

Answer 4

A pentester will be given a mix of known and unknown. The provider to the third-parties may only give the essential information about the systems to the testers and everything else, the pentesters will have to figure and document for themselves.

Question 5

Explain the Rules of Engagement for Penetration Testing

Answer 5

These are important documents that are designed to define the scope and purpose of the penetration test and makes everyone aware of the test parameters. These can define the type of test performed. There will be a list of devices that are in-scope and those that are out-of-scope. It also goes over how to handle sensitive data.

Question 6

Explain lateral movement in penetration testing

Answer 6

It is when a pentester moves from system to system while inside of a network. The network is very weak on the inside.

Question 7

Explain Privilege escalation in penetration testing

Answer 7

It is when a pentester elevates the privileges in order to carry out or have access to permissions or content that would be restricted otherwise.

Question 8

Explain persistence in penetration testing

Answer 8

This is where a pentester will create multiple ways in which they can regain access to the system easier without having to execute the exploiting again. Setting up backdoors, making user accounts, changing registries, etc.

Question 9

Explain cleanup in penetration testing

Answer 9

A pentester will want to revert the systems back to the way they are prior to the testing performed so they will try to leave the network in its original state, remove any binaries or temporary files, remove backdoors, delete user accounts created during the test, etc.

Question 10

Explain a bug bounty in Penetration Testing

Answer 10

In some cases, people are able to make a living on performing penetration tests and discovering bugs for companies that will pay good money for the discovery of these bugs.

Question 11

Explain pivoting in penetration testing

Answer 11

It is a system that will be the jumping off point that can be used to access other systems that would normally be inaccessible. It can also mask the attacker’s actual information by impersonating a device on a system carrying out the attacks.

Question 12

Explain passive and active reconnaissance

Answer 12

Before you attack a system, network, or application, you need to gather information and learn everything you can. Things like firewalls, security configs, etc need to be learned.

Question 13

Explain drones in passive or active reconnaissance

Answer 13

Drones can be used to fly over organizations to start gathering information from wireless networks, physical security, devices being used, etc.

Question 14

Explain war flying in passive or active reconnaissance

Answer 14

It is used to combine wifi monitoring and a GPS to get an idea of the wireless network you are trying to get information from. You can get more info on the wireless network, like the APs, network name, type of device being used, etc. For flying

Question 15

Explain War driving in passive or active reconnaissance

Answer 15

It is used to combine wifi monitoring and a GPS to get an idea of the wireless network you are trying to get information from. You can get more info on the wireless network, like the APs, network name, type of device being used, etc. For driving.

Question 16

Explain footprinting in passive or active reconnaissance

Answer 16

Passive footprinting involves gathering information in a way that would not be seen by the victim. Accessing social media, online forums, reddit, a corporate website, social engineering.

Active footprinting involves actively trying to gather information in a way that can be seen. Like trying to gain entry into a building, trying to actively gain access to a network will be seen through network traffic monitoring tools, using ping scans, port scans, DNS queries, OS Scans, OS fingerprinting, etc.

Question 17

Explain OSINT in passive or active reconnaissance

Answer 17

You can find information on anyone or anything online through many open sources. Many tools are available to automate gathering.

Question 18

Explain Red-team

Answer 18

Offensive security teams that are hired to hack. They are ethical hackers that try to find security holes, exploit vulnerabilities, social engineer, web app scanning, etc.

Question 19

Explain Blue-team

Answer 19

This is the team that is on defense that protect the data. They do operational security, incident response, threat hunting, digital forensics, etc. They protect the networks.

Question 20

Explain White-team

Answer 20

They oversee the interactions between red team and blue team. They facilitate tests and give reports to both red and blue teams.

Question 21

Explain Purple-team

Answer 21

This is a red team and blue team that will share information that they find on the network to help fortify and make sure a network is secure, actively finding vulnerabilities, and working to patch these vulnerabilities, etc.