1.8 Penetration test techniques

Question 1

What is a penetration testing?

Answer 1

A penetration test, also known as a pen test, is a simulated cyber attack against your computer system to check for exploitable vulnerabilities

Question 2

What are the rule of engagement for pentest?

Answer 2

• Define purpose and scope
• Make everyone aware of the test parameters
• Type of testing and schedule (on-site, internal/external test)
• List the rules (IP address ranges, how to handle sensitive info, in scope and out of scope device/applications)

Question 3

What is a unknown environment pentest?

Answer 3

The pentester knows nothing about the systems under attack. Also called ‘blind test’

Question 4

What is a known environment pentest?

Answer 4

Full disclosure of information on the target

Question 5

What is a partially known environment pentest?

Answer 5

Mix of known and unknown, it focuses on certain systems or applications

Question 6

What a pentester should do prior to exploiting any vulnerability?

Answer 6

• Seek for approval before exploiting because it can cause a DoS, loss of data
• Find the best way to gain access to the system (password brute-force, social engineering, DB injections, buffer overflow

Question 7

What is the process of pentesting?

Answer 7

• Initial exploitation: get into the network
• Lateral movement: move form system to system, inside the network
• Persistence: once you gain access, you need to make sure there’s a way back in so you can set up a backdoor, build user accounts, change pwd setting
• The pivot: gain access to systems that would normally not be accessible and gain access to other trusted system on the inside

Question 8

What to do after the pentest is over?

Answer 8

• Cleanup: leave the network in its original state, remove binary or temporary files, remove any backdoor, delete user account created during the test

Question 9

What is a bug bounty?

Answer 9

A reward for discovering vulnerabilities, you need to document the vulnerability to earn cash

Question 10

What is the purpose of reconnaissance phase ?

Answer 10

• Collect information before the attack
• Gathering a digital footprint
• Understand the security posture
• Minimize the attack area (focus on key systems)
• Create a network map (identify routers, network devices etc)

Question 11

What is a passive footprint?

Answer 11

Learn as much as you can from open sources: social media, corporate web site, online forum (reddit), social engineering, dumpster diving

Question 12

Is OSINT a passive footprint technique ?

Answer 12

Yes, OSINT help gathering information from many open sources (check the OSINT framework)

Question 13

What is wardriving / warflying?

Answer 13

A passive footprint technique which combine wifi monitoring and a GPS (to seek where a wireless device might be). With this technique, we are gathering info as we drive/fly around the city

Question 14

What is active footprint?

Answer 14

Gathering information via ping scan, port scans, analyse DNS queries, OS scans, OS fingerprints, service/version scans

Question 15

Security team involves …

Answer 15

operational security, penetration testing, exploit research, web application hardening etc

Question 16

What is a red team?

Answer 16

A red team is a group that plays the role of an adversary to provide security feedback from an antagonist’s perspective: exploit vulnerability, use social engineering, web application scanning

Question 17

What is a blue team?

Answer 17

Defensive team incharge of the operational security, incident response, threat hunting (update vulnerability, applu patches and updates etc) and digital forensics (data)

Question 18

What is a purple team?

Answer 18

Red and blue team working together. Both team cooperate, share data, give feedbacks etc

Question 19

What is a white team?

Answer 19

They manage the interections between red teams and blue teams. It can be the referees in a security exercice: enforce rules, resolves issues, determines the score. They also manage the post-event assessments (lessons learned, results etc)