1.8 Explain the techniques used in penetration testing. Flashcards
During a pentest, which team acts as the facilitators
Purple Team
During a pentest,which team is responsible for setting the rules of engagement and monitor the pen test
White Team- This group typically consists of the managers or team leads.
During a pentest,which team is one of two teams competing in pen test in a defensive role.
Blue Team
During a pentest, which team is competing with an offensive role.
Red Team
What is footprinting
obtaining information about a host or network topology
What is persistence in the pen test steps
occurs when the pen tester attempts to map out the internal network and discover the services running on it and accounts configured to access it.
What are the steps in a Pentest
- Perform Reconnaissance
- Scan/enumerate
- Gain Access
- Maintain Access
- Report
Type of pen test where The ethical hacker is given partial information of the target or network, such as IP configurations, email lists, etc. This test simulates the insider threat.
Gray box
Type of pen test where The ethical hacker has no information regarding the target or network. This type of test best simulates an outside attack and ignores insider threats.
Black box
Type of pen test where The ethical hacker is given full knowledge of the target or network. This test allows for a comprehensive and thorough test, but is not very realistic.
White box
In a Pen test, what happens during the perform recon phase?
The first phase in the pentesting process is reconnaissance, also known as footprinting. In this phase, the pentester begins gathering information on the target. This can include gathering publicly available information, using social engineering techniques, or even dumpster diving.
In a Pen test, what happens during the Scan enumerate phase?
Running scans on the target is the second phase. During this phase, the ethical hacker is actively engaged with the target.
Enumeration is part of the scanning phase. Enumeration uses scanning techniques to extract information such as:
Usernames
Computer names
Network resources
Share names
Running services
In a Pen test, what happens during the Gain access phase?
The third phase takes all of the information gathered in the reconnaissance and scanning phases to exploit any discovered vulnerabilities in order to gain access.
After gaining access, the pentester can perform lateral moves, pivoting to other machines on the network. The pentester will begin trying to escalate privileges with the goal of gaining administrator access.
In a Pen test, what happens during the Maintain access phase?
Once the pentester has gained access, maintaining that access becomes the next priority. This can be done by installing backdoors, rootkits, or Trojans.
In a Pen test, what happens during the report phase?
The final phase is generating the test results and supporting documentation. After any penetration test, a detailed report must be compiled. Documentation provides extremely important protection for both the penetration tester and the organization.
