PENETRATION TESTING LECTURE SLIDES start
- 1. PENETRATION TESTING AFRICA CENTRE OF EXCELLENCE, OBAFEMI AWOLOWO UNIVERSITY CYBERSECURITY MODULAR WORKSHOP @ ISLAMIC UNIVERSITY IN UGANDA (MAY 22ND – MAY 26TH, 2023) AKINWALE ABIODUN PH.D. MD/CEO LOGITRONIC SYSTEMS LTD, NIGERIA
- 2. INTRODUCTION ❑BACKGROUND ❑ Simulated Attack on a System or Network to Evaluate its Security. ❑ “Surgical Operation” Identifies the Strengths and Weaknesses of a Deployment in a Holistic Assessment for Risks ad the Remediation ❑STEPS SUMMARY ❑Scanning Target Devices (Server, Workstations, Mobile Devices, etc (Wireshark) ❑Find Vulnerabilities / Loopholes to be Exploited to Gain Control (Nmap) ❑Post Exploitation Escalation of Privileges (Metasploit/Metasploitable) 20XX 2
- 3. INTRODUCTION ❑VULNERABILITY ASSESSMENT ❑ A Systematic Review Of Security Weaknesses In An Information System (3 Steps): ❑ Evaluates System Susceptibility to Known Vulnerabilities ❑ Quantifies and Assigns Severity Levels to the Vulnerabilities ❑ Recommends Remediation or Mitigation Whenever Needed Through Reports ❑ Examples of Threats Preventable by VA: ❑ SQL Injection Attack, XSS, Other Code Injections ❑ Escalation of Privileges Due to Faulty Authentication Mechanisms ❑ Insecure Defaults – Software that Ships with Insecure Settings, Such Guessable Admin Passwords. 20XX 3
- 4. INTRODUCTION ❑TYPES OF VULNERABILITY ASSESSMENT ❑Host Assessment – The Assessment of Critical Servers, Which may be Vulnerable ❑Network And Wireless Assessment – The Assessment of Policies and Practices to Prevent Unauthorized Access ❑Database Assessment – The Assessment of Databases or Big Data Systems for Vulnerabilities and Misconfigurations, Identifying Rogue Databases or Insecure Dev/Test Environments ❑Application Scans – The Identifying of Security Vulnerabilities in Web Applications and Their Source Code by Automated Scans 20XX 4
- 5. INTRODUCTION ❑ DEFINITION: Penetration Test (Pen Test), Authorised Simulated Cyber Attack to Test for Vulnerabilities ❑ Companies realize that they can’t make every system 100% secure, they are extremely interested to know exactly what kind of security issues they are dealing with on ❑ Computer Systems ❑ Applications (APIs, Frontend/Backend Servers, etc.) ❑ Networks ❑ RESULTS ❑ Fine-tune (Web Application Firewalls) WAF Security Policies ❑ Patch Detected Vulnerabilities. ❑ Deploy IPS/IDS ❑ Pen Testing Satisfies Compliance Requirements for security Auditing Procedures, including PCI DSS and SOC 2 20XX 5
- 6. PHASES OF PENETRATION TESTING SAMPLE FOOTER TEXT 20XX 6 ❑ PHASE 1: PLANNING AND RECONNAISSANCE (Active and Passive Operations) ❑ Define Scope and Goals of Test: ❑ Systems to be Addressed ❑ Test Methods ❑ Intelligence Gathering ❑ Find Network and Domain Names, Mail Server ❑ Understand the Target ❑ Check for Potential Vulnerabilities
- 7. PHASES OF PENETRATION TESTING SAMPLE FOOTER TEXT 20XX 7 ❑ PHASE 2: Scanning - Determine How Target Responds to Attacks (Three types: ❑ 1. Port Scanning – Detecting Open Ports and Running Services on Target Host. ❑ 2. Network Scanning – Discovering IP Addresses, Operating Systems, Topology, Protocols, etc. ❑ 3. Vulnerability Scanning – Scanning to gather information about known vulnerabilities in a target. ❑ Static Analysis: Inspect Application’s Entire Code to Estimate its Behaviour ❑ Dynamic Analysis: Inspect Web Application’s Code in Running or Production State
- 8. PHASES OF PENETRATION TESTING SAMPLE FOOTER TEXT 20XX 8 ❑ PHASE 3: Gaining Access – The Ultimate Goal of Penetration Testing or The Attack Phase ❑ Gaining Access Could be as Easy as Accessing an Exposed private URL. ❑ You May Use Attacks such as Cross-Site Scripting (CSS), SQL Injection and Backdoors, to Expose Vulnerabilities ❑ Run Exploits Against Target to Gain Access i.e. Exploit Vulnerabilities: Escalate Privileges, steal Data, Intercept Traffic ❑ Run Exploits only When Necessary So as Not to Disrupt Production Lines
- 9. PHASES OF PENETRATION TESTING SAMPLE FOOTER TEXT 20XX 9 ❑ EXPLOITS: A Piece of Code That Takes Advantage of a Vulnerability to Cause Unintended Behavior in the Software ❑ TYPES OF EXPLOITS: ❑ Remote exploits – Typically Used Across a Network to Hit a Remote System ❑ Local Exploits – Used to Exploit Vulnerabilities locally. E.g. Elevate the Privileges of a User on a Machine ❑ Client Side Exploits - Relies mostly on Social Engineering Techniques e.g. Sending a Malicious File that can Exploit a Vulnerable Software (Example: Internet Explorer, Adobe Reader, etc.) on Victim’s Machine. Attacker gains Access to Victim’s Machine Remotely
- 10. PHASES OF PENETRATION TESTING SAMPLE FOOTER TEXT 20XX 10 ❑ PHASE 4: Maintaining Access – The Attack Phase ❑ Maintain Persistent presence in Exploited System ❑ Elevate Access: ❑ Horizontal Privilege Escalation (Same Level) ❑ Vertical Privilege Escalation (Low to Higher) ❑ Imitate Advanced Persistent Threats ❑ Steal an Organization’s Most Sensitive Data.
- 11. PHASES OF PENETRATION TESTING SAMPLE FOOTER TEXT 20XX 11 ❑ PHASE 5: Analysis/Covering Tracks – Report of Pen Test and Mitigation ❑ Vulnerabilities Exploited ❑ Sensitive Data Accessed ❑ Amount of Undetected Exploitation Time
- 12. PENETRATIONTESTING METHODS ❑ EXTERNAL TESTING ❑ Target Visible Assets of a Company to Gain Access ❑ Web Application ❑ Company Website ❑ Email ❑ Domain Name Servers (DNS ❑ INTERNAL TESTING ❑ Simulates Attack Behind the Firewall ❑ BLIND TEST ❑ Only the Name of the Enterprise is Known by Tester i.e. Severely limited Information.
- 13. PENETRATIONTESTING METHODS ❑ DOUBLE-BLIND TESTING (D-BLIND) ❑ Company’s Internal Cybersecurity Personnel and System User Unaware of Test ❑ Gold Standard in Pen tests ❑ TARGETED TESTING ❑ Pen Tester and Internal Cybersecurity Personnel Work Together
- 14. PENETRATIONTESTING AND FIREWALLS ❑ PEN TEST AND WEB APPLICATION FIREWALLS ❑ Mutually exclusive ❑ Tester Uses WAF Logs for Exploitation ❑ WAF Configurations Updated after Pen Tests
- 15. PENETRATION TESTING TOOLS ❑ NETSPARKER - Accurate Automated Scanner ❑ Can Identify SQL Injection Cross- site Scripting ❑ No False Positives ❑ ACUNETIX - Automated Web Vulnerability Scanner ❑ Detects over 4500 Web Application vulnerabilities Including SQLi and XSS. SAMPLE FOOTER TEXT 20XX 15
- 16. PENETRATION TESTING TOOLS ❑ CORE IMPACT ❑ Claims Largest Database ❑ With Over 20 Years’ Experience ❑ INTRUDER ❑ Over 9,000 Security Checks ❑ ASTRA ❑ Over 3000 Tests Available SAMPLE FOOTER TEXT 20XX 16
- 17. PENETRATION TESTING TOOLS ❑ METASPLOIT ❑ Most Advanced and Popular Framework ❑ Based on the concept of “Exploit” ❑ Has Command-line and the GUI ❑ Works on Linux, Apple Mac OS X, and Microsoft Windows ❑ WIRESHARK (+NMAP) ❑ Network Protocol Analyzer ❑ Works on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD SAMPLE FOOTER TEXT 20XX 17
- 18. A PENETRATION TESTER PROFILE ❑ SPECIALISATION ❑ Networks and Infrastructures ❑ Windows, Linux and Mac Operating Systems ❑ Embedded Computer Systems ❑ Web/mobile Applications ❑ SCADA (supervisory control and data acquisition) control systems ❑ Internet of Things (IoTs). SAMPLE FOOTER TEXT 20XX 18
- 19. A PENETRATION TESTER PROFILE ❑ RESPONSIBILITIES ❑ Understand Complex Computer Systems and Technical Cyber Security Terms ❑ Work With Clients to Determine Their Requirements From The Test, e.g. The Number And Type of Systems They Would Like Testing ❑ Plan And Create Penetration Methods, Scripts and Tests ❑ Carry Out Remote Testing of A Client's Network or Onsite Testing Of Their Infrastructure to Expose Weaknesses in Security ❑ Simulate Security Breaches to Test a System's Relative Security 20XX 19
- 20. A PENETRATION TESTER PROFILE ❑ RESPONSIBILITIES ❑ Create Reports and Recommendations from Findings, Including Security Issues Uncovered and Level of Risk ❑ Advise on Methods to Fix or Lower Security Risks to Systems ❑ Present your Findings, Risks and Conclusions to Management and Other Relevant Parties ❑ Consider the Impact Your 'Attack' Will Have on the Business and Its Users ❑ Understand How the Flaws that you Identify Could Affect a Business, or Business Function, If They’re not Fixed. 20XX 20
- 21. A PENETRATION TESTER PROFILE ❑ SKILL SET ❑ In-depth Understanding of Computer Systems and Their Operation ❑ Excellent Spoken and Written Communication to Explain your Methods to a Technical and Non-technical Audience ❑ Attention to Detail, to be Able to Plan and Execute Tests While Considering Client Requirements ❑ Ability to Think Creatively And Strategically to Penetrate Security Systems ❑ Good Time Management and Organisational Skills to Meet Client Deadlines ❑ Ethical Integrity to Be Trusted With a High Level of Confidential Information 20XX 21
- 22. A PENETRATION TESTER PROFILE ❑ SKILL SET ❑ Ability to Think Laterally and 'Outside The Box' ❑ Teamwork Skills, to Support Colleagues and Share Techniques ❑ Exceptional Analytical and Problem- solving Skills and The Persistence to Apply Different Techniques to Get The Job Done ❑ Business Skills to Understand the Implications of Any Weaknesses You Find ❑ Commitment to Continuously Updating Your Technical Knowledge Base ❑ Good Knowledge of Phyton ad Scripting 20XX 22
- 23. A PENETRATION TESTER PROFILE ❑ CERTIFICATION ❑ CREST Registered Penetration Tester (CRT) ❑ Offensive Security Certified Professional (OSCP) ❑ Certified Ethical Hacker (CEH) Certification ❑ GIAC Certified Penetration Tester (GPEN) ❑ Company Certification Schemes from Major Vendors and Equipment Providers like Microsoft (MCP) or Cisco (CCNA Security) 20XX 23