ITEC441- IS Security

Chapter 15 – Performing a Penetration Test

 1

The PenTest
• A penetration test (pentest) simulates methods that intruders
use to gain unauthorized access to an organization’s network
and systems and to compromise them.
• The purpose of a penetration test is to test the security
implementations and security policy of an organization.
• The goal is to see if the organization has implemented security
measures as specified in the security policy.
• A hacker whose intent is to gain unauthorized access to an
organization’s network is different from a professional
penetration tester.
• The professional tester lacks malice and intent and uses their
skills to improve an organization’s network security without
causing a loss of service or a disruption to the business.
 2

Defining Security Assessments

• A penetration tester assesses the security posture
of the organization as a whole to reveal the potential
consequences of a real attacker compromising a
network or application.
• Security assessments can be categorized as:
– security audits,
– vulnerability assessments, or penetration testing.
• Each security assessment requires that the people
conducting the assessment have different skills
based on the scope of the assessment.
 3

Defining Security Assessments

• A security audit and a vulnerability assessment
scan IP networks and hosts for known security
weaknesses with tools designed to
– locate live systems,
– enumerate users,
– and identify operating systems and applications,
looking for common security configuration mistakes and
vulnerabilities.
• A vulnerability or security assessment only
identifies the potential vulnerabilities whereas a pen
test tries to gain access to the network.
 4

Defining Security Assessments

• An example of a security assessment is looking at
a door and thinking if that door is unlocked it could
allow someone to gain unauthorized access,
• whereas a pen test tries to open the door to see
where it leads.
• A pen test is usually a better indication of the
weaknesses of the network or systems
• but it is more invasive and therefore has more
potential to cause disruption to network service.
 5

Penetration Testing
• There are two types of security
assessments:
– External assessments
– Internal assessments.
• An external assessment
– Tests and analyzes publicly available information,
– Conducts network scanning and enumeration,
– Runs exploits from outside the network perimeter,
usually via the Internet.
 6

Penetration Testing
• An internal assessment is performed on the
network from within the organization,
– with the tester acting either as an employee with some
access to the network or
– as a black hat with no knowledge of the environment.
• A black-hat penetration test usually involves a
higher risk of encountering unexpected problems.
• The team is advised to make contingency plans in
order to effectively utilize time and resources.
 7

Penetration Testing
• You can outsource your penetration test if you don’t have
qualified or experienced testers
• On your security assessment, you must specify the scope of
the assessment, including what is to be tested and what is not
to be tested.
• For example, a pen test may be a targeted test limited to the
first 10 systems in a demilitarized zone (DMZ) or a
comprehensive assessment uncovering as many vulnerabilities
as possible.
• In the scope of work, a service-level agreement (SLA) should
be defined to determine any actions that will be taken in the
event of a serious service disruption.
 8

Penetration Testing
• Other terms for engaging an assessment team can
specify a desired code of
– conduct,
– the procedures to be followed, and
– the interaction or lack of interaction between the
organization and the testing team.
• A security assessment or pen test can be performed
manually with several tools, usually freeware or
shareware, though the test may also include
sophisticated fee-based software.
• A different approach is to use more expensive
automated tools.
 9

Penetration Testing
• Assessing the security posture of your organization
using a manual test is sometimes a better option
than just using an automated tool based on a
standard template.
• The company can benefit from the expertise of an
experienced professional who analyzes the
information.
• While the automated approach may be faster and
easier, something may be missed during the audit.
 10

Penetration Testing
• However, a manual approach requires
– planning,
– scheduling, and
– diligent documentation.
• The only difference between true “hacking”
and pen testing is permission.
• It is critical that a person performing a
penetration test get written consent to
perform the pen testing.
11
 12

Penetration Testing Steps

• Penetration testing includes three phases:
– Pre-attack phase
– Attack phase
– Post-attack phase
• The pre-attack phase involves
reconnaissance or data gathering.
• This is the first step for a pen tester.
 13

Penetration Testing Steps

• Gathering data from Whois, DNS, and
network scanning can help you map a
target network and provide valuable
information regarding the operating system
and applications running on the systems.
• The pen test involves locating the IP block
and using Whois domain name lookup to find
personnel contact information, as well as
enumerating information about hosts.
 14

Penetration Testing Steps

• This information can then be used to create a
detailed network diagram and identify targets.
• You should also test network filtering devices to
– look for legitimate traffic,
– stress-test proxy servers, and
– check for default installation of firewalls
• to ensure that
– default users IDs,
– passwords, and
– guest passwords
• have been disabled or changed and no remote login
is allowed.
 15

Penetration Testing Steps

• Next is the attack phase,
• During this phase, the tools can range from
exploitive to responsive.
• They’re used by professional hackers to
monitor and test the security of systems and
the network.
• These activities include but aren’t limited to
the following:
 16

Penetration Testing Steps

• Penetrating the Perimeter
– This activity includes
• Looking at error reports,
• Checking access control lists by forging
responses with crafted packets, and
• Evaluating protocol filtering rules by using
various protocols such as SSH, FTP, and
telnet.
 17

Penetration Testing Steps

• Penetrating the Perimeter
– The tester should also test for
• Buffer overflows,
• SQL injections,
• Bad input validation,
• Output sanitization, and
• DoS attacks.
– In addition to performing software testing, you should
allocate time
• To test internal web applications and
• Wireless configurations,
– Because the insider threat is the greatest security threat
today.
 18

Penetration Testing Steps

• Acquiring the Target
– This set of activities is more intrusive and challenging than
a vulnerability scan or audit.
– You can use an automated exploit tool like CORE IMPACT
or attempt to access the system through legitimate
information obtained from social engineering.
– This activity also includes testing
• The enforcement of the security policy, or
• Using password cracking and privilege escalation tools
– To gain greater access to protected resources.
 19

Penetration Testing Steps

• Escalating Privileges
– Once a user account has been acquired, the
tester can attempt to give the user account more
privileges or rights to systems on the network.
– Many hacking tools are able to exploit a
vulnerability in a system and create a new user
account with administrator privileges.
 20

Penetration Testing Steps

• Executing, Implanting, and Retracting
– This is the final phase of testing.
– Your hacking skills are challenged by escalating privileges
on a system or network while not disrupting business
processes.
– Leaving a mark can show where you were able to gain
greater access to protected resources.
– Many companies don’t want you to leave marks or execute
arbitrary code, and such limitations are identified and
agreed upon prior to starting your test.
 21

Penetration Testing Steps

• The post-attack phase involves restoring the
system to normal pretest configurations,
• which includes
– Removing files,
– Cleaning Registry entries if vulnerabilities were created,
and
– Removing shares and connections.
• Finally, you analyze all the results and create two
copies of the security assessment reports,
– One for your records and
– One for management.
 22

Penetration Testing Steps

• These reports include
– Your objectives,
– Your observations,
– All activities undertaken, and
– The results of test activities,
– Recommend fixes for vulnerabilities.
 23

The Pen Test Legal Framework

• A penetration tester must be aware of the legal
ramifications of hacking a network, even in an
ethical manner.
• The documents that an ethical hacker performing a
penetration test must have signed with the client are
as follows:
– Scope of work, to identify what is to be tested
– Nondisclosure agreement, in case the tester sees
confidential information
– Liability release, releasing the ethical hacker from any
actions or disruption of service caused by the pen test
 24

Automated Penetration Testing Tools

• The following should be considered the top pen
testing tools in a hacker’s toolkit:
• (Up to Fyodor (http://insecure.org/fyodor/))
• Nessus
– This freeware network vulnerability scanner has more than
11,000 plug-ins available.
– Nessus includes remote and local security checks, a
client/server architecture with a GTK graphical interface,
and an embedded scripting language for writing your own
plugins or understanding the existing ones.
 25

Automated Penetration Testing Tools

• GFI LANguard
– This is a commercial network security scanner for Windows.
– GFI LANguard scans IP networks to detect what machines are
running.
– It can determine the host operating system, what applications are
running, what Windows service packs are installed, whether any
security patches are missing, and more.
• Retina
– This is a commercial vulnerability assessment scanner from eEye.
Like Nessus,
– Retina scans all the hosts on a network and reports on any
vulnerabilities found.
 26

Automated Penetration Testing Tools

• CORE IMPACT
– CORE IMPACT is an automated pen testing product that is
widely considered to be the most powerful exploitation tool
available (it’s also very costly).
– It has a large, regularly updated database of professional
exploits.
– Among its features, it can exploit one machine and then
establish an encrypted tunnel through that machine to
reach and exploit other machines.
 27

Automated Penetration Testing Tools

• ISS Internet Scanner
– This is an application-level vulnerability assessment.
– Internet Scanner can identify more than 1,300 types of
networked devices on your network, including desktops,
servers, routers/switches, firewalls, security devices, and
application routers.
• X-Scan
– X-Scan is a general multithreaded plug-in-supported
network vulnerability scanner.
– It can detect service types, remote operating system types
and versions, and weak usernames and passwords.
 28

Automated Penetration Testing Tools

• SARA
– Security Auditor’s Research Assistant (SARA) is a
vulnerability assessment tool derived from the System
Administrator Tool for Analyzing Networks (SATAN)
scanner.
– Updates are typically released twice a month.
• QualysGuard
– This is a web-based vulnerability scanner.
– Users can securely access QualysGuard through an easy-
to-use web interface.
– It features more than 5,000 vulnerability checks, as well as
an inference-based scanning engine.
 29

Automated Penetration Testing Tools

• SAINT
– Security Administrator’s Integrated Network Tool (SAINT) is
a commercial vulnerability assessment tool.
• MBSA
– Microsoft Baseline Security Analyzer (MBSA) is built on the
Windows Update Agent and Microsoft Update
infrastructure.
– It ensures consistency with other Microsoft products and,
on average, scans more than 3 million computers each
week.
 30

Automated Penetration Testing Tools

In addition to this list, you should be familiar with the
following vulnerability exploitation tools:
• Metasploit Framework
– This is an open source software product used to develop,
test, and use exploit code.
• Canvas
– Canvas is a commercial vulnerability exploitation tool.
– It includes more than 150 exploits.
 31

Pen Test Deliverables

• The main deliverable at the end of a penetration test is the pen
testing report.
• The report should include the following:
– A list of your findings, in order of highest risk
– An analysis of your findings
– A conclusion or explanation of your findings
– Remediation measures for your findings
– Log files from tools that provide supporting evidence of your
findings
– An executive summary of the organization’s security posture
– The name of the tester and the date testing occurred
– Any positive findings or good security implementations
 32

The Last Words

• Security auditing or pen testing is a necessary part
of running a secure networking environment.
• It is critical that a trusted and knowledgeable
individual such as a CEH test the systems,
applications, and components to ensure all security
findings can be addressed by the organization.
• The organization can use the pen testing report as a
measure of how successfully they have
implemented the security plan and to make
improvements on the data security.