Pentesting workshop with Kali Linux - Part I

<br /><br />Contents<br /><br />0.- Pre - Boarding<br /><br />1.- What is Penetration Testing<br /><br />2.- Types of Tests in a Penetration Testing <br /><br />•   Gray Box Testing - "Gray Box" / "Partial Disclosure"<br />•   White Box Testing - "White Box" / "Full Disclosure"<br />•   Black Box Testing - "Black Box" / "Blind"<br /><br />3.- Categorization of a Penetration Testing<br /><br />•   External Intrusion<br />•   Internal Intrusion<br /><br />4.- Methodologies<br /><br />•   OSSTMM (Open Source Security Testing Methodology)<br />•   ISSAF (Information Systems Security Assassment Framework)<br />•   Penetration Testing Framework  (Vulnerability Assessment  Penetration Testing Execution Standard)<br />•   OWASP<br /><br /><br />

---

<br /><br />Pre – Boarding<br /><br />Before starting this workshop, let me introduce myself: I am Jose Moruno Cadima A.K.A Snifer, and I will be acting as a "tutor" in quotation marks; quite the contrary, I will be sharing the little knowledge I have gained in my professional life. I have the pleasure of working in the field of information security, so I am continually improving and acquiring new knowledge. <br /><br /><br /> <br />In the Workshop we will cover everything related to Pentesting: the Kali Linux distribution (which was chosen for its quality and the support of the community that keeps it constantly updated), we will learn how the tools work, and in real environments we will set targets to be scanned and gather information from.   Another important aspect to highlight is that there will be some papers with Hacks and Tips related to Pentesting, in which some Security tool will be covered that will not be directly related to the content of the current Paper. <br /><br /><br />What is Penetration Testing<br /><br />Before defining what Penetration Testing is, we should first think about how we understand or interpret it. <br /><br />What is it to you?<br /><br />"Please, before continuing, ask yourself: what is a Penetration Test?"<br /><br />Now let's see what the main sources of information say, taking Wikipedia, OSSTMM, and NIST, in order to get a more accurate understanding, allowing us to continue the Workshop with the necessary knowledge.<br /><br /><br /><br />"A method of evaluating the security of a computer system or network by simulating an attack from a hostile source" (Wikipedia)<br /><br />"A security test with a specific objective that ends when that objective is achieved or the available time runs out" (OSSTMM – Open Source Security Testing Methodology Manual)<br /><br />"Security testing in which evaluators mimic real-world attacks to subvert the security features of an application, system, or network" (NIST – National Institute of Standards and Technology)<br /><br />To me, Penetration Testing is a set of techniques that allow you to evaluate the security level of an organization or a service provided. <br />Therefore, Penetration Testing makes it possible to identify technological weaknesses by finding vulnerabilities through simulating the behavior of intruders. Performing such a test does not certify that a system is "secure"; today it may be secure at 00:00 but at 00:01 it is no longer secure, because everything is constantly being updated. On the other hand, the Human Factor comes into play -which out of laziness or simplicity does not change or leaves default configurations- in addition to the fact that absolute security does not exist, it is only a false illusion of security, for which the following analogy is illustrative.<br /><br />- Why do we have walls in our houses?<br />- Why do we have a door in our home?<br /><br />The answers can be summed up as: "We only give ourselves a false sense of being safe, that nobody will be able to watch us or steal our belongings; because if a thief wants to get into your house, they will". The same happens with information security: no matter how sure we are that nothing bad will happen, Murphy's Law shows up. <br /><br /><br /><br />Currently, Penetration Testing is considered one more resource within companies' security tasks, since some have a specific area entirely dedicated to this activity. A Penetration Testing can have different scopes, taking into account what is wanted and the definition of what will and will not be done.<br /><br /><br />Types of Tests in a Penetration Testing<br /><br />When performing a Penetration Testing there are 3 types of test: Black, White and Gray Box.  Each of them is described in more detail below.<br /><br />Black Box Testing - "Black Box" / "Blind"<br /><br />It consists of obtaining as much information as possible, since there is no prior knowledge or information about the system or network to be analyzed.<br /><br />White Box Testing - "White Box" / "Full Disclosure"<br /><br />The consultant has access to all the information, that is, infrastructure, Network topology, IP Addresses, application source code, etc. <br /><br />Gray Box Testing - "Gray Box" / "Partial Disclosure"<br /><br />It is a middle ground between Black and White (whose combination gives us gray), a mix of both; this means partial knowledge is obtained and, since it is limited, not everything is known in detail; this definition comes from the counterpart, that is, the client requesting the test. <br /><br /><br />Categorization of a Penetration Testing<br /><br />There are mainly two types:<br /><br />• External Intrusion<br />• Internal Intrusion<br /><br />Below we briefly explain what each one consists of: <br /><br />• External Intrusion<br /><br />The goal or purpose of an external intrusion is to access the organization's internal machines, escalate privileges and obtain root (Administrator) access. It is worth noting that this process is carried out with the aim of accessing the DMZ (Demilitarized Zone) from outside, through a series of techniques ranging from Social Engineering, Sniffing, Password Cracking; in short, the pentester's best cards are brought out.<br /><br />• Internal Intrusion<br /><br />As its name indicates, an internal intrusion takes place inside the organization by connecting to a physical point or Wifi network -if applicable- in order to demonstrate how insecure the technological infrastructure is by emulating an internal attacker; of course, with the lowest privileges. In this test, the goal is to escalate and see what information is exposed, whether in shares, servers, default passwords, or poorly configured services. <br /><br /><br /><br /><br />Since you ask, it is worth remembering that denial of service attacks are coordinated in the internal stage, since being inside the company we could bring down a machine that is critical to it. In the external stage, on the other hand, prior coordination with anyone is not necessary, since anyone can run one.<br /><br /><br />But what is a DoS or Denial of Service?<br /><br />Right, we forgot to explain what a denial of service is! It's not too late to do so; a denial of service consists of saturating a service with many requests at once, these being concurrent in such a way as to exceed its concurrency capacity. For example, if we all leave class at the same time we won't be able to get through the main door, thus causing a denial of service. What is the service? The door that gives us the option to get out.<br /><br />A graphical description of a Denial of Service.<br /><br /><br /><br />A Penetration Test generally has 4 main stages:<br /><br />Reconnaissance<br />Scanning<br />Enumeration<br />Gaining access (Backdooring)<br /><br />We will break down each of these stages in the upcoming installments.  In this first one, it is enough to know they exist; bearing in mind that if something is mentioned and not explored in depth, it is recommended that you start searching for information on your own. These workshops aim to give a general overview and -at the same time- be a little push for you to feel encouraged to dig deeper. <br /> <br /><br />Methodologies<br /><br />When performing a Penetration Testing -most of the time- already defined Methodologies that meet certain standards are taken as a basis. They also make it possible to identify the main weaknesses of the institution; below are some of them, the ones that -in my experience- I consider the main ones or that provide the most value when used.<br /><br />OSSTMM (Open Source Security Testing Methodology)<br />ISSAF (Information Systems Security Assassment Framework)<br />Penetration Testing Framework  (Vulnerability Assessment  Penetration Testing Execution Standard)<br />OWASP<br /><br />Breaking down each one makes no sense, since they are properly documented on their respective sites; perhaps in future installments we will devote a deeper or more specific analysis to them.<br />To finish this first installment, I leave you a couple of questions -which I'd prefer- be answered in the forum:<br /><br />1.- Do you prefer to perform the tests in real environments or controlled environments, that is, use a real online site as an example, or set up a test lab and work on it locally?<br /><br />2.- Suggestions, comments, any point you would like to see in the next workshop as the first bonus.<br /><br /><br /><br />