Penetration testing better known as a pen test is the process where somebody manifest themselves as
an outsider and actually tries to grab sensitive data sensitive information from within your infrastructure.
Now you've got to be careful or you don't want to confuse a vulnerability assessment with a penetration
test a vulnerability assessment.
At no time will ever actually try to grab the data a penetration test will actually try to grab the
data itself.
So when we're talking about a penetration test there's a few steps that are always going to take place.
Number one you're going to be discovering vulnerabilities in this case you're going to be doing some
form of reconnaissance.
You're going to be trying to get information.
And in many cases you actually end up using vulnerability scanners to do that.
Second and this is what you would never do in a vulnerability assessment is you're actually going to
exploit those vulnerabilities.
You're going to go in and you're going to grab usernames and passwords.
Are you going to pull down the database or you're going to corrupt the web page you're going to actually
do some form of exploit that does something very concrete to that target network.
So those are your first two steps.
Well your third step actually you know what let's make this the first step your first step before you
do any of this stuff is authorization because of the implicit naughtiness of the penetration test the
buy in from management.
The authorization is incredibly important at the very minimum you're going to have to do two things.
Number one you're going to have to define the targets most the time when you're doing a pen test you're
trying to say you know can you do this can you crack our Web site or something like that.
But the second thing you're going to have to define is something known as the attack model unattacked
model defines what the attacker knows before they do a penetration test.
The first attack model is known as a white box.
In this case the attacker has extensive knowledge about the target.
They know IP addresses.
They know who's running what.
They might even have user names and passwords.
In this case attackers are more like trusted insiders.
This is the cheapest and fastest type of attack model for a pin test.
On the other side is a black box attack model.
In this case the attackers know nothing about the target.
This is more where the attackers are like strangers.
And invariably this is going to be some form of external hacking.
The downside to black boxes is that they are potentially expensive and slow due to the nature of the
amount of time we need for reconnaissance and alternative is what we call a gray box the gray boxes
somewhere between the two extremes for example we may know where a sequel server is but we may not have
usernames passwords or something like that.
So you've got it worked out with upper management that you're going to do some form of pen test.
So let's kind of march through the processes that are actually going to take place.
Once you've been given the go ahead to get started.
So the first thing we're going to be doing is we're going to be discovering vulnerabilities.
To me this is more what I call the reconnaissance mode.
Now you've got three different ways to do an exploration to discover these vulnerabilities.
First of all you can do what's known as a passive discovery with a passive what you're talking about
is you're not putting any of your packets onto the target so you can be doing a who is look up for example
or you can be making some phone calls with a passive you're not doing anything from a computer that's
sending packets over to your target.
The second thing would be semi passive.
So the passages you're actually putting packets onto the target but you're not doing anything that would
raise any alarms or set off a intrusion detection or anything like that.
So for example you've got a target web server that you're looking for.
You could just go to the Web site and check it out a little bit and go to do whatever reconnaissance
you need to do in that particular situation.
The third one is an active discovery an active reconnaissance in this situation.
You are actually putting packets downrange on the target you're running scanners you're running unmap
you're running tools like that that could possibly alert an intrusion detection system or block you
by a intrusion prevention system or by a firewall.
The bottom line is that you're going to go through these processes and in these cases you're often just
using standard vulnerabilities scanners to get this reconnaissance information.
But you do reach a point re suddenly go.
I have a target.
I wonder if it has a particular exploit.
And that's where we need to talk about exploiting the target.
No.
By the way the tools that I tend to use when I'm exploiting the target are probably the most single
famous one is the infamous met a spoiler.
And in particular I'm a big fan if you've been watching any of my other episodes I love Cali Linux distro
it's a big popular one.
It includes Metis spoilt as long as a lot of other tools go along with it.
The thing to keep in mind about métis point is that métis point is not a program.
All right it's a it's a penetration testing what we call a framework.
It really gives you little more than a command line and a number of tools that allow you to make an
exploit.
So for right now let's go ahead and talk about what we have to do to exploit a target and then we'll
take a look at middes point when we're in a Target we're ready to exploit it.
First we're going to start off with some initial exploitation based on the idea of banner grabbing.
Here's an example of me banner grabbing a web site using telnet.
I have enough information that allows me to try to do some form of initial exploitation.
Now this initial exploitation in and of itself may be sufficient but we can often do is do something
what's known as a pivot a pivot is nothing more than an initial exploitation which allows us to act
as a launching point to do even more exploitation.
So for example if I were to be able to get root access to a system that is in and of itself a exploitation.
However once I have root access I can treat that as a pivot to do all kinds of interesting things.
The other thing to keep in mind is that we do what's known as persistence persistence simply means that
we keep doing something for a while.
Most good penetration testing doesn't happen over the course of a few hours or a few days what will
normally take place is it will go over weeks looking for a particular issue.
Last and this is what it's all about is escalation of privilege as I just described getting root access
is the holy grail of penetration testing.
So what I've got here in front of me is good old men is spoilt now Mendus ploy is a framework it's not
a single program but as a framework it allows me to run different programs that will work together and
know what each other is doing so métis point is absolutely amazing.
Now what I'm doing is I'm running something called Armitt Taj.
On top of métis boy Armitt ties just helps me run with the framework a little bit.
So if we take a look here this is Taj but down here is just good ole met a sport right here.
And that MSF means métis point framework.
So for example if I want to take a look at all the stuff that's going on for SMB clients on this network
you can see that I run this unmap but I run a Met a split script right here so this dot in a c file
is basically it's a script and it runs through and it does all kinds of stuff.
So it's going through and it's looking for user names for SMB.
You can see a lot of these are disabled unfortunately.
Let's keep scrolling.
It took me a minute but there it is.
This is not a disabled account.
So there is an account called NSF admin on a particular system.
So the cool part about this is and I jump ahead a little bit remember that with pen testing we're going
to first discover our vulnerabilities so I can run and map and tools like that and it does this pretty
little graphical representation of all the different systems that have found on this network.
So the reconnaissance does a really really good job.
Now if I were to run a spoiler in its typical way I would then start running these very esoteric commands
of one type or another and I would be injecting all of these different types of exploits métis boy literally
uses vulnerability databases and you can look for particular vulnerabilities.
But what netspeak does it's particularly nice is that it does a banner grab on the system so it'll sit
there and go on.
This is a window system or whatever it might be that's running this version of Apache web server or
whatever it is and then it makes a listing of the types of attacks you can do.
This is where Armytage the graphical front end becomes kind of nice if you take a like a look here you
can see I can pick different attacks and it's only showing me the ones that can do.
If you take a look over here it's services you can see here here's this computer 192 168 5.9.
And look at all the open services this thing's running just about everything there is in fact this is
a very specific type of machine called met a spoiled table.
And it's actually a virtual machine that's designed for people to attack.
It's a fun thing to practice on.
And as you can see by looking at this easy it's running just about everything you could possibly think
of.
And the fun part is as we can just right click on this guy pick an attack
lots and lots of HTP attack.
Let's try that again.
And it will go ahead and do that attack for me with that guy launch
and maybe it'll work and maybe it won't.
It just depends on the patch level for that particular system.
So make sure you're familiar with métis boy it's probably the first go to pen testing tool that's out
there.
And don't you ever call it a program.
It's a framework.