Penetration (pen) Testing

Penetration testing, or pen testing for short, is the process of testing a website or other digital system for vulnerabilities that could be exploited by attackers. Penetration testing typically involves simulating various types of attacks to see how the system responds and to identify potential weaknesses that could be exploited by attackers.

Steps

  • Note: Unauthorized pen testing is illegal and could result in criminal charges.Take appropriate precautions to avoid causing any harm or disruption to the website or its users during the testing process
StepDescription
1. Define the scope of the testDetermine what parts of the website will be tested, what types of attacks will be simulated, and any limitations or constraints that need to be taken into consideration.
2. Reconnaissance/ScoutingConduct a thorough reconnaissance of the website and any associated systems to identify potential vulnerabilities or weaknesses.Ping probes, port scanning, or traceroute or finger-printing are practical examples of active reconnaissance.
3. Vulnerability scanningUse automated tools to scan the website and associated systems for known vulnerabilities. Example: QL injection or cross-site scripting (XSS) vulnerabilities.
4. Manual testingPerform manual testing to identify any additional vulnerabilities or weaknesses that may not have been identified by automated tools.
5. ExploitationAttempt to exploit any vulnerabilities that have been identified to see if they can be used to gain unauthorized access or perform other malicious activities.
6. ReportingDocument all findings and provide recommendations for remediation

Reconnaissance/Scouting

The process of gathering information about a target system or network before attempting to launch a pen testing. It is an important step since it helps the tester to identify potential vulnerabilities and weaknesses in the target system, network or application.

StepDescription
Passive reconnaissanceThis involves gathering information about the target system, network or application without actively engaging with it. This includes searching for information on search engines, social media, and other publicly available sources.
Active reconnaissanceThis involves actively engaging with the target system, network or application to gather information. This includes techniques such as port scanning, network mapping, and fingerprinting.
Social engineeringThis involves using psychological manipulation to gather information from people associated with the target system, network or application. This includes techniques such as phishing, pre-texting, and baiting.
Open-source intelligence (OSINT)This involves gathering information from publicly available sources such as company websites, job postings, and news articles.

Vulnerability scanning

StepDescription
1. PlanningIdentify the scope of the scan, including the systems, networks, or applications to be scanned, and the types of vulnerabilities to be checked.
2. ScanningUse a vulnerability scanning tool to scan the target systems, networks, or applications to identify vulnerabilities, misconfigurations, or weak points that could be exploited.
3. AnalysisReview the scan results to prioritize the vulnerabilities based on their severity, potential impact, and exploitability.
4. ReportingGenerate a report that summarizes the vulnerabilities found, their severity, and recommendations for remediation
5. RemediationAddress the vulnerabilities by applying patches, updating configurations, or implementing other measures to mitigate the identified risks

Vulnerability scanning Tools for Linux

ToolDescription
OpenVASCan detect thousands of known vulnerabilities in Linux systems. It includes a web-based user interface and can be configured to run scheduled scans.
NiktoCan identify vulnerabilities in web servers and web applications running on Linux systems. It includes over 6,700 checks for potential vulnerabilities and misconfigurations.
Nmap - Network MapperNetwork scanner that can identify open ports, running services, and potential vulnerabilities in Linux systems. It includes a wide range of features, including version detection and OS fingerprinting.
LynisSecurity auditing tool that can identify vulnerabilities in Linux systems. It includes over 200 tests for security and compliance

Sample Pen Test Report

SectionDescription
Executive SummaryProvides a high-level overview of the penetration test results, including the scope, objectives, key findings, and recommendations for remediation.
Scope and MethodologyOutlines the scope of the penetration test, including the systems, networks, or applications tested, and the methodology used to conduct the test.
VulnerabilitiesProvides a detailed description of the vulnerabilities found during the test, including their severity, potential impact, and recommendations for remediation.
ExploitationProvides details on how the vulnerabilities were exploited during the test, including the tools and techniques used.
RecommendationsProvides recommendations for remediation, including prioritization of vulnerabilities and specific steps to be taken to address the identified risks.
ConclusionSummarizes the key findings and recommendations of the penetration test, and emphasizes the importance of addressing the identified vulnerabilities to improve the overall security of the organization
AppendicesIncludes additional information such as network diagrams, screenshots, and raw data from the penetration test.