I was charged to do some basic penetration testing on our system. I tried to find some favoured practices but I was not successful. I guess SYN attack is retired (no NT here). Could anyone advice some basic steps of what to test in order to proceed at least very basic penetration test? Thanks
First of all, you should get an idea of the attack surface. Since you talk of a 'penetration test' you should start with no previous information.
For that, you could use
If you have time, use the full port range and set operating system and service identification
The result should give you an idea of the different network services you could potentially penetrate.
You can also try NSE scripts from nmap which extends nmap capacity for discovery.
Next, try to find vulnerabilities to those services. You could do this on several ways:
After discovering vulnerabilities, if you are entitled to, you could try to really exploit them. This could mean:
If you can exploit some system or service, try to pivot from there to expand your attack surface.
It is important how you communicate your results. Try to tell all your tests (whether successfull or not). Try to give some metrics about the results (number of open ports (total and mean by host), number and importance of vulnerabilities, etc.). If you exploit a vulnerability, record it as a video and take some screenshots.
Explain the importance of your discoveries and, if you can, relate it to business loss.
And don't forget that...
...penetration testing is not conclusive. At the end, you will be somewhere of the following indicator about the state of your network (as Markus said, wrote and showed in his rear guard security podcast).
I'm a novice, but the Official Nmap handbook is not only incredibly comprehensive and well-written, but provides general procedures for network vulnerability scanning. If that's what you're looking for, I recommend that.
for local level use kon boot from kryptos logic, to show authentication weakness from non crypted hdds and no bios password. for vulnerability scanning there is a 5 user freeware from rapid7.com (it is good). for proof of concept use metasploit (Free). nmap could be useful.