Eth H Flashcards
What is an external network pentest?
Looking at an organization’s security from the outside of an organization.
What does OSINT stands for?
Open Source Intelligence
On what methodology does the external network pentest focuses heavily?
On OSINT Gathering
What examples are there of an external network pentest?
Hacking the target server from another country, from another office or a house.
What does OSINT Gathering consist in?
On gathering as much intel and data about an organization.
Their employees, their email format.
Have they ever been involved in a breach? If so can we have access to the breached data? Were there any passwords among that data?
Is there any data we can collect to breach a login panel or breach a VPN o r breach any area we otherwise would not be allowed into?
What is an internal network pentest?
Assessing the organization´s security from inside of the network.
What example could there be for an internal network pentest?
A phishing email or a person who actually had access to the building could leave some unwanted software. This already gives access to the network. And what we test is what else can we breach after that.
On what methodology do internal network pentests primarily focus on?
On Active Directory Attacks
What is a web application pentest?
Its assessing an organization’s web applications’ security
On what methodology do web application pentests primarily focus on?
On web-based attacks and on the OWASP testing guidelines.
What does OWASP stands for?
Open Web Applications Security Project
What is a Wireless pentest?
Its assesing an organization’s wireless network security.
On what factors does the methodology used for a wireless pentest depends on?
On the wireless type being used
(guest vs WPA-PSK vs WPA2 Enterprise)
What device do you need to perform wireless pentests?
A wireless network adpater
What is a physical pentest?
Assessing an organization’s physical security
On what factors does the methodology used for physical pentests depends on?
On tasks and goals set by the client.
Mention other types of assesments that a pentester may perform:
Mobile Penetration Testing
IoT Penetration Testing
Red Team Engagements
Purple Tem Engagements
What is report writing for?
To communicate findings and recommendations from pentest assessment.
How much time is it typically expected for a report writing to be delivered in?
About a week after the engagement ends.
What are the 2 types of findings that the report should highlight?
Non-technical (executive) and technical findings.
How should the recommendations be in the report writing?
Recommendations for remmediation should be as clear as possible for both, the executive viewpoint and the technical staff viewpoint.
How is a debrief performed?
A debrief is basically the walthrough of your report findings. This is done for both technical and non-technical staff.
Debrief must be able to be explained at a high-level and at a low-level depending on an audience.
Why is the debrief important?
Because it gives the client an opportunity to ask questions and address any concerns they might have.
