Planning and Scoping Penetration Tests Flashcards
What is Vulnerability Assessment?
the practice of evaluating a computer system, a network, or an application to identify potential weaknesses. It is typically performed using an automated tool, which produces a list of vulnerabilities based on known signatures. Many of these can be false positives or not actually exploitable.
What is Penetration Testing?
Penetration testing, or pen testing, goes beyond simple vulnerability testing. It seeks to exploit vulnerabilities and produce evidence of success as part of its report. It often includes social engineering and testing of physical controls, as well as testing technical weaknesses.
What occurs during the Planning phase?
Most recognized pen test processes include a planning phase. Depending on the authority that promulgates the process, this phase might also include identifying the scope of the engagement, documenting logistical details, and other preliminary activities that need to occur before the commencement of the pen test.
Reconnaissance In the reconnaissance phase, the tester gathers information about the target organization and systems prior to the start of the pen test. This can include both passive information gathering, such as collecting publicly available information about the organization, and deliberate acts, such as scanning ports to detect possible vulnerabilities.
What occurs during the Scanning phase?
The scanning phase is generally a bit more in depth than the reconnaissance phase. This is where vulnerability assessment begins. Static and dynamic scanning tools evaluate how a target responds to intrusions.
What occurs during the Gaining Access phase?
This phase is when the actual exploit begins, by applying the information gained by reconnaissance and scanning to begin to attack target systems.
What occurs during the Maintaining Access phase?
In this phase, the pen testers install mechanisms allowing them to continue to access the system. This phase is also where pen testers reach deeper into the network by accessing other network systems.
Covering tracks This phase concentrates on obliterating evidence that proves an exploit occurred. It generally consists of two facets: avoiding real-time incident response efforts and avoiding post-exploit forensic liability.
What occurs during the Analysis phase?
In this phase, the pen tester gathers all the information collected, identifies root causes for any vulnerabilities detected, and develops recommendations for mitigation
What occurs during the Reporting phase?
The reporting phase is where the information from testing and analysis are officially communicated to the stakeholders. Although reporting requirements can vary due to customer needs or statutory regulations, most pen test reports list: • Vulnerabilities detected. • Vulnerabilities exploited. • Sensitive data accessed. • How long the pen tester had access. • Suggestions and techniques to counteract vulnerabilities.
infrastructure, the specific needs of an organization should guide the need for additional or different process stages for pen testing.
What is Nmap?
An open source network scanner used for network discovery and auditing. It can discover hosts, scan ports, enumerate services, fingerprint operating systems, and run script-based vulnerability tests.
What is Nikto?
An open source web server scanner that searches for potentially harmful files, checks for outdated web server software, and looks for problems that occur with some web server software versions. It is included with Kali Linux.
What is OpenVAS
(Open Vulnerability Assessment System) An open source software framework for vulnerability scanning and management.
What is SQLmap?
An open source database scanner that searches for and exploits SQL injection flaws. It is included with Kali Linux.
What is Nessus?
A proprietary vulnerability scanner developed by Tenable Network Security. Initially open source, it scans for vulnerabilities, misconfigurations, default passwords, and susceptibility to denial of service (DoS) attacks. It can also be used for preparation for PCI DSS audits.
What is Hashcat?
A free password recovery tool that is included with Kali Linux and is available for Linux, OS X, and Windows. It includes a very wide range of hashing algorithms and password cracking methods. Hashcat purports itself to be the fastest recovery tool available.
What is Medusa?
A command-line-based free password cracking tool that is often used in brute force password attacks on remote authentication servers. It purports itself to specialize in parallel attacks, with the ability to locally test 2,000 passwords per minute.
What is THC-Hydra?
A free network login password cracking tool that is included with Kali Linux. It supports a number of authentication protocols.
What is John The Ripper?
A free password recovery tool available for Linux, 11 versions of Unix, DOS, Win32, BeOS, and OpenVMS. It is included with Kali Linux.
What is Cain and Abel?
A free password recovery tool available for Windows that is sometimes classified as malware by some antivirus software.
What is Mimikatz?
An open source tool that enables you to view credential information stored on Microsoft Windows computers. It is also included with Kali Linux.
What is Whois?
A protocol that queries databases that store registered users or assignees of an Internet resource, such as a domain name.
What is Nslookup?
A Windows command-line utility that queries DNS and displays domain names or IP address mappings, depending on the options used.
What is FOCA?
(Fingerprinting and Organization with Collected Archives) A network infrastructure mapping tool that analyzes metadata from many file types to enumerate users, folders, software and OS information, and other information.
theHarvester A tool included with Kali Linux that gathers information such as email addresses, subdomains, host names, open ports, and banners from publicly available sources.
What is Shodan?
A search engine that returns information about the types of devices connected to the Internet by inspecting the metadata included in service banners.
What is Maltego?
A proprietary software tool that assists with gathering open source intelligence (OSINT) and with forensics by analyzing relationships between people, groups, websites, domains, networks, and applications. A community version named Maltego Teeth is included with Kali Linux.
What is Recon-ng?
A web reconnaissance tool that is written in Python and is included with Kali Linux. It uses over 80 “modules” to automate OSINT. Some of its features include: search for files, discover hosts/contacts/email addresses, snoop DNS caches, look for VPNs, look up password hashes, and perform geolocation.
What is Aircrack-ng?
A suite of wireless tools, including airmon-ng, airodump-ng, aireplay-ng, and aircrack-ng. Included with Kali Linux, the suite can sniff and attack wireless connections, and crack WEP and WPA/WPA2-PSK keys.
What is OWASP ZAP?
(Open Web Application Security Project Zed Attack Proxy) An open source web application security scanner.
Burp Suite An integrated platform included with Kali Linux for testing the security of web applications. Acting as a local proxy, it allows the attacker to capture, analyze, and manipulate HTTP traffic.
