Book: CH 1 Flashcards
Assessment Methodology:
PTES
Penetration Testing Execution Standard
- Built around expectations of the attacker’s actions / how they operate
Assessment Methodology:
OSSTMM
Open Source Security Testing Methodology Manual
- Built around expectations of the attacker’s actions / how they operate
Security Testing Methodology:
Cyber Kill Chain
- Military concept of the structure of an attack
- Identify where the attacker is in their process so you can adapt your own response tactics.
Lockheed Martin adapted the military concept to the info security space
Security Testing Methodology:
Attack Life Cycle
- Describes exactly how attackers have operated since the attacks started against computing infrastructure
- Rather than a theoretical exercise / military focus
- Recognizes that usually an attack is not 1-and-done, there is a loop that happens in the middle
- They use the compromised systems to launch additional attacks within the environment
- These attacks don’t happen quickly, it can take days or weeks to move to each of the phases
- These are usually organizations NOT individuals
List The Phases of
The Cyber Kill Chain
(7 Phases)
aka: Phases of the Intrusion Kill Chain
Phases of The Cyber Kill Chain:
Phase 1:
Reconnaissance
Identify target and potential points of attack
Phases of The Cyber Kill Chain:
Phase 2:
Weaponization
- May create a custom piece of malware that is specific to the target
- May use common off-the-shelf (COTS) malware too
Phases of The Cyber Kill Chain:
Phase 3: Delivery
How you get the weapon
Phases of The Cyber Kill Chain:
Phase 4: Exploitation
- Could be when the mailicious software infects the victim’s system
Exploitation leads to installation
Phases of The Cyber Kill Chain:
Phase 5: Installation
- The attacker will install additional software to maintain access to the system
- May setup remote access
Phases of The Cyber Kill Chain:
Phase 6: Command & Control
- Gives attackers remote access to the infected system
- May involve additional software installation or sending directives to infected system
Also Seen As: C2 or C&C
Phases of The Cyber Kill Chain:
Phase 7: Actions on Objective
- Attackers have goal objectives they are trying to achieve
- The attacker may try to get info or make the system perform actions (Example: DoS)
The attacker won’t stop until they achieve their objectives, so there’s a lot of activity in this phase
Phases of The Attack Life Cycle:
Phase 2: Initial Compromise
Usually launches Phishing Attacks to gain access
Phases of
Attack Life Cycle
Phases of The Attack Life Cycle:
Phase 1: Initial Recon
Identifies victim and potential attack possibilities using open source intelligence and public sources
Example: social media
Phases of The Attack Life Cycle:
Phase 3: Establish a Foothold
Once the system is compromised, make sure to retain access to get back in when needed
Phases of The Attack Life Cycle:
Phase 4: Escalate Privileges
- Attacker needs admin privileges to move into the loop that happens
- as they keep moving & gathering additional systems and credentials
Phases of The Attack Life Cycle:
Phase 5: Internal Recon
- Investigating connections within the system and with other systems in the network
- Trying to identify other credentials that are known in the system
Phases of The Attack Life Cycle:
Phase 6: Move Laterally
- aka: East-West movement
- Attackers need to know what systems there are: servers, workstations
Phases of The Attack Life Cycle:
Phase 7: Maintain Presence
- With every system the attacker gets access to, they need to maintain it
- Any malware that is allowing access needs to remain running
Phases of The Attack Life Cycle:
Phase 8: Complete Mission
- Where data may be exfilitrated from the environment
- May not be a 1 time thing, they may continue to find additional targets in the environment
Security Testing Methodology:
MITRE ATT&CK Framework
- Is a taxonomy of TTPs (techniques, tactics & procedures)
- Real world TTPs organized into categories
- Continually updates, no step-by-step instructions, only high-level descriptions of activities
Stages of The
ATT&CK Framework
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command & Control
- Exfiltration
- Impact
Stages of The ATT&CK Framework:
Methodology of Ethical Hacking
- Reproduce what real-life attackers would do
- Info Security is not just protection or prevention. You need to be able to detect all of these attacker activities
Ethical Hacking Methodology:
Reconnaissance & Footprinting
Determine the size and scope of your test
- Reconnaissance - gather info about your target to understand the scope up front to help you narrow your actions so you don’t do anything unethical
- Footprinting - understanding the org’s footprint by identifying network blocks, hosts, locations & people
Ethical Hacking Methodology:
Gaining Access
- Many consider this to be the most important / interesting part of a pen test
- Demonstrating where some services are potentially vulnerable by exploiting the service
Ethical Hacking Methodology:
Scanning & Enumeration
- After network blocks are identified, you want to identify systems that are accessible within those network blocks
- Identify services running on any available host, these will be used as entry points.
- Exposed network services: list of all open ports and identify service & software running behind each open port
- The more info gathered here the easier the next stage will be
Ethical Hacking Methodology:
Maintaining Access
- Emulating common attack patterns
- May need to install a rootkit, which gives backdoor access and obscure you actions and existence on the system.
- Persistence - install software that reaches out to systems on the internet because inbound access is often blocked by a firewall.
Outbound access is often allowed from the inside of a network in a completely unrestricted manner
Ethical Hacking Methodology:
Covering Tracks
- Hide/delete all evidence of your access and continued access
- Malware can ensure that your actions aren’t logged or can misreport info to the system
- Sometimes your actions to cover your tracks can leave evidence of your actions
