Pentest Theoretical Foundations

What is Penetration Testing?

To begin with, we propose to figure out what is penetration testing? In this article, we will look at what penetration testing or pentesting is and why it is important. We then look at the different types of penetration tests and the different approaches that are used by information security professionals. The National Institute for Security and Technology defines penetration testing as security testing, during which experts simulate real attacks to identify methods for bypassing the built-in security system of an application, infrastructure or network. This often includes the use of real attacks on systems that are in production, as well as attacks to gain access to confidential information using tools and techniques commonly used by hackers. Now, When cyberattacks become the norm, it is more important than ever to conduct regular vulnerability scans and penetration testing to identify vulnerabilities and ensure that the security system in place is working. Considering the fact that real attacks on systems in production are not something that will happen monthly or quarterly. Many companies are reluctant to conduct a penetration test, for example, once a year, let's say for show, ignoring the importance of these events for the business.

Now that we've highlighted the importance of penetration testing, we need to identify the various approaches we can use to conduct a penetration test. One penetration test in different companies will not give us the same result, because each company uses different tools, systems, applications. The key principle here is flexibility in your approaches. As you know, eighty percent of attacks occur within the company, so it is important to test the system as an employee or as a former (possibly offended) employee. Already having access to some of the information systems, we can go further than, say, if we were an external hacker who would simply use the most popular tools. The next approach is to browse the web or mobile apps,. These methods usually include checking the security of the code and compliance with the information security policy. There are many attempts at authentication and password cracking, not forgetting social engineering. By itself, social engineering creates focuses on the psychological aspects within someone in order to gain access to information that you would not normally receive. Historically, we know social engineering as email phishing attacks, but attacks can also be phone calls, etc.

This is often done through threats, ultimatums, misinformation, creating a sense of urgency, escalating, and creating a situation in which you force someone to divulge information or gain access to something that you usually do not have access to. Next come wireless networks. Let's say we know that most companies will have an internal wireless network for all of their employees, so it is very important that we test it and make sure it complies with the information security policy. Since every employee connects to this internal network, they often try to use their own devices, be they phones or laptops. Thus, they all become targets for attacks that we can test. Even outside of work, many things today are connected to the Internet, be it webcams, thermostats or even coffee makers. In other words, it is necessary to consider all the different approaches that we have at our disposal.

Industrial control systems are historically very outdated with their passwords, with their own operating systems, and are very susceptible to social engineering attacks because they often use default passwords and default configurations. Nowadays, industrial management systems do not exist everywhere, but mainly in the oil, gas and electrical industries. But you can imagine that compromised industrial systems can cause very great damage to both the enterprise and the country, its ecology, etc. and in general, they incur economic, reputational and other losses, therefore it is most important to check them.

As I mentioned in the original definition of penetration testing, penetration tests can be performed on a variety of applications, networks and systems, as well as on mobile devices and various operating systems. While each of these different approaches may be different, the methodology we use remains the same as there will always be an initial phase of planning, when you write the contract, the agreement with the company that will determine the scope of the attack, and since you are attacking the real system. it is very important that you set very strict boundaries and be very clear about what can and cannot happen. Once you have a plan that spells out what you want to do, the exploration or discovery stage will follow, where you get as much information as possible, both actively and passively. As soon as you feel that you have enough information, you will move on to exploiting vulnerabilities. Then, when the attack is completed or you have completed everything that you intended to accomplish during the planning stage, it is time to compile a report, where it is extremely important for the customer to reflect which attacks were successful and which were not.

Pentest  Tools

All information systems are vulnerable. It depends on a number of things, such as the constant changes that our ICs undergo in the form of updates and configuration changes, as well as the ability for attackers to take advantage of gaps and vulnerabilities in these systems. Fortunately, pentesters or ethical hackers are nowadays an integral part of a comprehensive information security system in organizations. However, before taking steps to eliminate iB threats, you need to familiarize yourself with penetration testing tools, which will be discussed in this article.

The most popular penetration testing tools are:

Kali Linux

Kali linux is a Linux distribution designed for forensics and penetration testing. Contains the most widely used penetration testing tools. Kali Linux OS is debian based and most of its packages are imported from Debian repositories. Kali includes over 500 pre-installed penetration testing programs. A recent update contains cloud penetration testing tools. Kali has partnered with some of the world's leading cloud platforms such as AWS and Azure to help transform the way we approach cloud security.

Metasploit

Metasploit is another popular penetration testing framework. It was created in 2003 using Perl and was acquired by Rapid7 in 2009, by which time it was completely rewritten in Ruby. It is a collaboration between the open source community and Rapid 7 that has resulted in the Metasploit project, well known for its anti-forensics tools. Metasploit is the concept of an “exploit”, which is code that can outperform any security measures included in vulnerable systems. Once traversed through firewalls, it acts as a “payload,” code that performs operations on the target machine, creating the ideal environment for penetration testing.

Wireshark

WireShark is one of the main and most popular network packet analyzers in the world.It was originally released as Ethereal back in 1998 and was renamed WireShark in 2006 due to some trademark issues. Users typically use WireShark for network analysis, troubleshooting, and software and communication protocol development. Wireshark mainly operates on the second to seventh layer of network protocols, and the analysis performed is presented in a human-readable form. Information security specialist and network forensics researchers use WireShark to analyze protocols, the number of bits and bytes passing through the network. Its ease of use functionality and the fact that it is an open source product make Wireshark one of the most popular packet analyzers for security professionals and network administrators.

Burp Suite

Threats to web applications have grown in recent years. Ransomware and cryptojacking have become more and more common methods used by attackers to attack users in the browser. Burp or Burp Suite is one of the widely used graphical tools for testing the security of web applications. As far as application security is concerned, there are two versions of this tool: the paid version, which includes all the functionality, and the free version, which comes with several important features.

This tool comes pre-installed with basic features to help you check the security of your web applications. If you want to get internet penetration testing it should definitely be in your arsenal, it works great on Linux as well as Mac and Windows.

Nmap

Nmap is a security scanner. As the name suggests, it builds a network map to discover nodes and services on a computer network. Nmap follows a set of protocols where it sends the generated packet to the target host and then parses the responses. It was originally released in 1997 and has since provided many features for detecting vulnerabilities and network failures. The main reason to choose Nmap is because it is able to adapt to network conditions such as network latency and network congestion during scanning.

To protect your environment from security threats, you must take the necessary steps.

There are many penetration testing tools with their exceptional capabilities. The most important thing is to choose the necessary tool based on the requirements or tasks. You can choose from the above tools as they are included in the shortlist and given the fact that they are efficient, well supported and easy to understand, and most importantly, they are open source. We advise you to study the presented penetration testing tools. In the following articles, we will dwell on each of them in detail.