1.8 Penetration Testing

Question 1

Penetration Testing: 3 levels of testing relevant to knowledge of the environment

Answer 1

1. Unknown (black box)
2. Known (white box)
3. Partial (gray box)

Question 2

Define penetration testing: rules of engagement

Answer 2

Defining the scope, what systems, when, who, etc.., of a penetration test prior to executing it so that everyone knows about since it may risk bringing systems down

Question 3

Define penetration testing: lateral movement

Answer 3

Once access is breached, testing to see how many internal devices can be breached

Question 4

Define penetration testing: persistence

Answer 4

Creating a back-door allowing one to return for access at a later time

Question 5

Define penetration testing: cleanup

Answer 5

After completion of a penetration test all systems and accounts need to returned to their previous state

Question 6

Define Bug Bounty

Answer 6

Rewards offered by companies to those to identify bugs or vulnerabilities in their systems/software

Question 7

Define Pivoting

Answer 7

Breaching a system and then using that system to launch further attacks or breach other systems

Question 8

How is passive/active reconnaissance relevant to penetration testing? (2)

Answer 8

1. Prior to a penetration test, information is gathered (reconnaissance) to identify potential vulnerabilities to test
2. Passive reconnaissance is not detectable by the organization but active reconnaissance, such as port scans, is detectable

Question 9

How are drones used for reconnaissance?

Answer 9

A drone can be used for war flying to gather information about available wireless networks

Question 10

Define footprinting

Answer 10

Gathering information to use for an attack, can be active or passive

Question 11

Define war driving

Answer 11

Driving around and identifying available WiFi networks

Question 12

Define war flying

Answer 12

Using a drone to fly around and scan for available wireless networks

Question 13

Define OSINT

Answer 13

Open-Source Intelligence, openly available information that attackers can use to craft an attack. Common sources include social media and company websites

Question 14

Define the “Red Team” in penetration testing

Answer 14

The attacking team

Question 15

Define the “Blue Team” in penetration testing

Answer 15

The defensive team, handles day-to-day security, responds to threats, maintains patches, recovers data/systems from attacks

Question 16

Define the “Purple Team” in penetration testing

Answer 16

The combination of both teams who work together in an organization to ensure security

Question 17

Define the “White Team” in penetration testing

Answer 17

The referee between red and blue teams, defines the rules and compiles the results of penetration tests