6

I was charged to do some basic penetration testing on our system. I tried to find some favoured practices but I was not successful. I guess SYN attack is retired (no NT here). Could anyone advice some basic steps of what to test in order to proceed at least very basic penetration test? Thanks

5 Answers 5

6

Attact surface

First of all, you should get an idea of the attack surface. Since you talk of a 'penetration test' you should start with no previous information.

For that, you could use nmap. If your objective is no stealth, just use connect scan. If you want to be more stealthy, use syn scan or any of the other scan methods. If you want to use it with other tools, you better configure XML output (alongside human, to be able to read it yourself).

If you have time, use the full port range and set operating system and service identification -O -sV. Be careful with UDP scan, as it can be quite slow.

The result should give you an idea of the different network services you could potentially penetrate.

You can also try NSE scripts from nmap which extends nmap capacity for discovery.

Vulnerability discovery

Next, try to find vulnerabilities to those services. You could do this on several ways:

  • Use an automated tool:
  • Search vulnerabilities databases based on version of services: OSVDB, securityfocus vulnerabilities, NVD, etc.
  • Test by hand, using curl, netcat, etc. if you know the service and can interact with it directly (e.g. mail servers, web servers, IMAP servers, etc.)

Exploit

After discovering vulnerabilities, if you are entitled to, you could try to really exploit them. This could mean:

  • Bruteforce authentication systems for the services found (including web sites). There are lots of tools for this. Nessus and OpenVAS can have dictionaries for common services.
  • Use metasploit with the results from Nmap and Nessus or OpenVAS to test if there are already exploits available (db_create and db_import_nmap_xml and db_import_nessus_nbe).
  • Look for exploits on sites like packetstorm or milw0rm or exploit-db. And care to analyze the code before launching them... or else...
  • Use the tools for exploiting vulnerabilities from w3af.

If you can exploit some system or service, try to pivot from there to expand your attack surface.

Results communication

It is important how you communicate your results. Try to tell all your tests (whether successfull or not). Try to give some metrics about the results (number of open ports (total and mean by host), number and importance of vulnerabilities, etc.). If you exploit a vulnerability, record it as a video and take some screenshots.

Explain the importance of your discoveries and, if you can, relate it to business loss.

More information

This is a very short review and I may have overlooked lots of information, you should read OSSTMM and OWASP testing guide for more information.

And don't forget that...

...penetration testing is not conclusive. At the end, you will be somewhere of the following indicator about the state of your network (as Markus said, wrote and showed in his rear guard security podcast).

Badness-o-meter
(source: rearguardsecurity.com)

2

Have you considered using tools such as Nessus or OpenVAS that will do that for you ?

0
2

I'm a novice, but the Official Nmap handbook is not only incredibly comprehensive and well-written, but provides general procedures for network vulnerability scanning. If that's what you're looking for, I recommend that.

0

for local level use kon boot from kryptos logic, to show authentication weakness from non crypted hdds and no bios password. for vulnerability scanning there is a 5 user freeware from rapid7.com (it is good). for proof of concept use metasploit (Free). nmap could be useful.

0

As a senior cyber security consultant, I would strongly advise against conducting any type of penetration testing without proper training, experience, and authorization from the system owner. Penetration testing can be a highly technical and complex process, and any mistakes or missteps can have serious consequences, including legal ramifications.

That being said, if you have been authorized and have the necessary training and experience to conduct a basic penetration test, here are some more detailed steps that can be taken:

Reconnaissance: This phase involves gathering information about the target system, including its IP address, open ports, and services running on those ports. This can be done using tools such as Nmap, which is a popular port scanning tool, and Recon-ng, which is a reconnaissance framework. Other tools that can be used for this phase include Whois, Shodan, and theHarvester.

Scanning: Once you have identified the target system and its services, you can move on to scanning for vulnerabilities. This can be done using tools such as Nessus or OpenVAS, which can perform comprehensive vulnerability scans and generate reports on potential weaknesses. Other tools that can be used for this phase include Nikto, which is a web server scanner, and Metasploit, which is a framework for developing and executing exploits.

Exploitation: If vulnerabilities are found during the scanning phase, you can attempt to exploit them to gain access to the target system. This can involve using a combination of automated tools and manual techniques to gain access to the system. Some common exploitation tools include Metasploit, Exploit-DB, and BeEF.

Privilege Escalation: Once access is gained, you can escalate privileges to gain greater access to the system and its data. This can involve using tools such as PowerSploit, which is a PowerShell-based penetration testing framework, and Mimikatz, which is a tool for retrieving sensitive information from Windows systems.

Covering Your Tracks: After conducting a penetration test, it is important to cover your tracks by deleting logs and other evidence of your presence on the system. This can be done using tools such as LogCleaner and Wipe.

Again, it is important to stress that conducting a penetration test without proper authorization and training is illegal and can result in serious consequences.

You must log in to answer this question.