Pen testing Methodology
pdf
keyboard_arrow_up
School
Grand Canyon University *
*We aren’t endorsed by this school
Course
320
Subject
Information Systems
Date
Dec 6, 2023
Type
Pages
7
Uploaded by BailiffKnowledge19216
1
Pen Testing Methodology
Adrian Andrade
Grand Canyon University
ITT-340
Ingrid Gaviria
Due September 23, 2023
2
Phases of Compromise and Pen-testing methodology
Before this begins, it is important to note that the pen-testing methodology being used here will
be PTES (or Penetration Testing Execution Standard). This standard is a comprehensive
framework for conducting penetration tests, and it designed to provide a structured approach for
performing and reporting results. With that out of the way, there are several similarities between
an attackers typical line of compromising a system, and this pen-testing methodology line of
phases.
An attacker will typically follow these seven steps: Reconnaissance, weaponization, delivery,
exploitation, installation, command and control, and action.
The goal of the first goal, called reconnaissance is to gain information about the target and find
it’s vulnerabilities.
This goal is completed when the attacker gains sufficient information about
the system to exploit one or more vulnerabilities. The second phase (called Weaponization) is
about creating malware or malicious payload that takes advantage of the vulnerability (or
vulnerabilities). The goal is complete when the attacker successfully creates malware tailored to
exploiting the specific weakness. The next step
Is called ‘Delivery’. The goal of this step is to
gain access to the target’s machine or network. This
can be done by sending malware in the form
of an email, or by calling the target and coaxing him/her into giving access. The goal is
completed when the attacker successfully gains access to the target machine.
The step after this is ‘Exploitation’. The goal of this step is to actually ex
ploit the weaknesses
found in the reconnaissance stage, and using the malware created in step 2. The goal is
completed when the weaknesses have been exploited, and the attacker is able to gain further
access into the target machine.
3
After this step is installation. The goal here is to successfully install malware and gain further
control of the target machine. Malware can be installed by using trojan horses, access token
manipulation, command-line interfaces, and backdoors. Each of these can be helpful in
completing the goal. Goal is completed by installing further malware and gathering more control
of system.
After installation, the next step is command and control. The main goal here to gain more control
of the system. Control to the point where the attacker can track, monitor, and guide their cyber
weapons. The attacker can also try and obfuscate and commence denial of service. Obfuscate is
the process in which an attacker covers their tracks and makes it seem as if nothing had occurred.
Denial of service is an attack that disrupts the host machine or network in the hopes of slowing
things, and distracting users.
The last and final phase of the steps is Action. The goal of this step is to achieve the main reason
for committing this attack in the first place. Which could be for gaining access to classified
documents, attacking critical infrastructure, or for money purposes. This step can take the longest
because it depends on how well the attack was performed overall.
The steps for the methodology is: Pre-engagement interactions, intelligence gathering, threat
modeling, vulnerability analysis, exploitation, post exploitation, and reporting.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
4
The first step of this methodology is Pre-engagement interactions. The goal of this step is get
everything out of the way before the work begins. This involves scheduling the engagement,
getting approval from the client, understanding
client’s objectives, and defining the overall scope
of the engagement. The goal is completed when all the pre-work is accomplished.
The next and most crucial step is intelligence gathering. The main goal of this step is to gather
intelligence about the target system. This could include data about the network infrastructure,
applications, and people who use it. The goal is completed when the system is fully understood
and have identified possible vulnerabilities.
After intelligence gathering is the next step, Threat modeling. The goal of this step is to create a
model of all potential threats that could be used to attack the system, and record them; then
decide which ones are most potent and address them first. This step is done when the model is
complete, and vulnerabilities catalogued.
Next step is Vulnerability analysis. The goal of vulnerability analysis is to analyze the system for
weaknesses. This includes identifying unpatched software vulnerabilities and misconfigurations
that could be exploited.
The last step of the methodology is exploitation. In this phase, the pen-tester will attempt to
exploit any vulnerabilities that were identified in previous phases.
As one might already deduce, the reconnaissance stage of the attacker steps, and the intelligence
gathering of the pen-test methodology seem very similar. Both steps begin much earlier down
the line, and have similar main goals. Which is to find vulnerabilities in the system, and to gather
information. Another similarity is that they both have the same step, which is exploitation. This
step is the same for both the attacker phases and the PTES methodology. Both have to do with
actually exploiting the vulnerabilities found in the reconnaissance/intelligence gathering phase.
5
Should pen-testing phases be in the scope?
Yes. That way if someone else (like the client for example) looks at scope, it’ll
make it easier for
them to know what is involved.
Pen Testing Motivation
Anybody who cares about their cyber security, will consider pen-testing cyber operations. This is
because in order to actually better secure your organization or business’s cyber s
ecurity, you
have to actually know what needs securing, and whether it is sufficiently secure. And one of the
best ways to do that is to pen-test. The main goal of pen-testing is find out where all the
vulnerabilities are, and to simulate a mock cyber
attack. This isn’t to just find vulnerabilities, it’s
also to simulate the damages as well, since it is still a sort-of a legitimate attack. Being subject to
leaks or something like a data breach can really motivate an organization to improve their
security. And the way to do that is to pen-test. At least to some extent.
Flaw Hypothesis
The flaw hypothesis methodology and the pen testing methodology intersect well in the first
step. Which is information gathering in flaw, and reconnaissance on pen-testing. This is because
6
they both have to do with gathering information. How could someone do a successful attack or
pen-testing without knowing the system they are invading?
Because OSSTMM is very focused on priority items that need to be tested, it could actually
focus the pen-testing methodology steps as well. The pen-testing methodology is very
generalized in that, it almost seems to say that “Yes, the goal is to test the network or host
machine” but what to test specifically is never stated. OSSTM
M can provide what to test, in
order to better the overall pen-test. Because now, the most important and vital items will be
tended to before anything else.
Ethical and legal Issues
If it were up to me to handle ethical and legal issues of cybersecurity, with the Christian
worldview in mind, I would try to help everybody or as much people as I can. I would try to
make sure my decisions were made from within the confines of the law.
But honestly I don’t
think I could make all legal and ethical issues align
just because it can’t happen all the time.
Sometimes, legal issues and ethical issues don’t align, and this can be because on one hand, a
s
ituation can be solved ethically, but legally, it shouldn’t be allowed. Or, a solution to an issue
can be done legally, but ethically, it becomes bad or un
clear. Thus, they don’t align, but I would
try nonetheless because it is better when they are aligned.
I think everybody would benefit from
following that verse. This includes people, and organizations. I think they would benefit because
we should be wise, and we should try hurt as few people as possible, because under the Christian
worldview, we are all important, and valuable.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
7
References
Keshri, A. (2023, April 12).
Top 5 penetration testing methodologies and standards
. Astra
Security Blog.
https://www.getastra.com/blog/security-audit/penetration-testing-
methodology/#osstmm
WSTG - v4.1
. WSTG - v4.1 | OWASP Foundation. (n.d.).
https://owasp.org/www-project-web-
security-testing-guide/v41/3-The_OWASP_Testing_Framework/1-
Penetration_Testing_Methodologies
Team, T. G. (2023, August 23).
Cyber security: Understanding the 5 phases of intrusion
.
Graylog.
https://graylog.org/post/cyber-security-understanding-the-5-phases-of-intrusion/
Cyber kill chains explained: Phases, Pros/Cons & Security Tactics
. Splunk. (2022, November
11).
https://www.splunk.com/en_us/blog/learn/cyber-kill-chains.html