Chapter 5: Penetration Testing Concepts Flashcards
is an intrusive test where a third party has been authorized to attack a company’s network to identify weakness. The intrusive tests used by them can cause damage to your systems
Penetration Test
work in an unknown environment and are given zero information on the company. They will carry out initial exploitation looking for vulnerabilities.
Black Box
work in a partially known environment as they are given limited information
Gray Box
work in a known environment. One of the purposes of white box pen testers is to test applications in a sandbox so that when they are released they do not have any vulnerabilities. They know everything about a system or application as they have access to an applications source code.
White Box
random information is inserted into an application to find out if the application crashes or gives out coding errors.
Fuzzing
type of attack is when an attacker gains access to a desktop computer inside a company, which they then use to launch an attack on another computer or server.
pivoting
this is where attackers move around your network looking for resources to exploit to avoid detection.
Lateral Movement
this is an attack over an extended period of time.
Peristence
where an attacker exploits a weakness in a system so that they can gain a higher level of privileges on it.
Escalation of Privilege
where someone actively tries to gain information about the system. For example, an attacker finds a username left on one of the corporate desktops; they then ring up the active directory team, pretending to be that person and requests a password reset.
Active Reconnaissance
where an attacker is constantly gathering information, without the victim’s knowledge.
Passive Reconnaissance
this could also use a drone with a laptop or Personal Digital Assistant so that they can map out wireless networks
War Flying
where someone drives around in a car mapping out wireless access points, including those that could be vulnerable.
War Driving
the process hackers would use to map out the entire network, including employees, computers, IP addresses, versions of operating systems, etc
Footprinting
this is intelligence collected legally from the public domain, such as social media or websites on the internet. It is used in law enforcement and business intelligence to help identify the source of attacks. It is only used for non-sensitive data.
Open Source Intelligence (OSINT)
mimics an attackers, and they try to find vulnerabilities within your company. They quite often use social engineering and phishing as a part of their attacks
Red Team
team that looks to discover security vulnerabilities within the company and take action to mitigate them so the company is secure.
Blue Team
organizes and adjudicates cybersecurity exercises based on the information given. They set the rules of engagement and details of the exercise.
White Team
is trained to be an attacker but has a defensive posture, and their focus is on repairing vulnerabilities as quickly as possible.
Green Team
can carry out the role of both blue and red teams. By combining these teams, they can discover the threat actors tactics. These guys could be auditors or external consultants.
Purple Team
passive scanner that identifies the vulnerabilities or weaknesses in a system. For example, there could be a missing update for the operating system, anti virus solutions, or account vulnerabilities.
Vulnerability Scanner
non profit organization that looks at different attack vectors—looks at computer flaws and can identify the platforms affected
Common Vulnerabilities and Exposure (CVE)
is built into many vulnerability scanners and indicates the severity of the vulnerabilities. Always deal with critical events first.
-False positive: scan believe there is a vulnerability but when you physically check it it not there
-False Negative: scanner does not detect actual vulnerability that exists. (Zero-day)
-True positive: results of the system scan agree wit manual inspection
-Log reviews: review logs after a vulnerability scan. Log files will list any potential vulnerabilities.
Common Vulnerabilities Scoring System (CVSS)
much more powerful version of a vulnerability scanner. It has higher privileges than a non-credentialed scan. It provides more accurate information and it can scan documents audit files check certificates and account information.
Credentialed Scan
lower privileges than a credentialed scan. It will identify vulnerabilities that an attacker would easily find.
Non-Credentialed Scan
passive and merely report vulnerabilities. They do not cause damage to your system
Non-Intrusive Scan
can cause damage as they try to exploit the vulnerability and should be used in a sandbox and not on your live production system
Intrusive Scan
automated tool that integrates all of your security processes and tools in a central location. An automated process that uses machine learning and artificial intelligence that makes it faster than humans searching for evidence of attacks.
-helps reduce the Mean Time to Detect (MTTD)
-uses playbooks that define an incident and the action taken
Security Orchestration Automation and Response (SOAR)
dynamic process of seeking out cybersecurity threats inside your network from attackers and malware threats
threat hunting
