ResearchPubsCVSchedule
Obscurity in CybersecurityML & AICloud (AWS) WorkshopAMI Privacy Data MiningEnergy Fraud DetectionGenCyberCoinNSF CC* Case Study
00 Background01 Social Engineering02 Assessment Planning03 Passive Intel04 Active Intel05 Exploitation06 Post-Exploitation07 Resources
Contact

Practical Security Assessment

0x??roll

Penetration Testing - How to Get Paranoid

Book

The material will be used from different sources as well as from my own experience. However, there two particular books that you should look into if you see cybersecurity as your possible future career: Hacker Playbook 2 and Hacker Playbook 3

Also, I found that this books is a good one to get really deep and really serious into pentesting: Advanced Penetration Testing: Hacking the World's Most Secure Networks

Methodology

  • Hacker VS Pentester?
    • Free-for-all VS Written authorization
  • Types of a pentest

Abstract methodology

Any methodology is not a holy grail => develop your own

  • Planning
  • Non-intrusive target search
  • Intrusive target search
  • Remote target assessment
  • Local target assessment
  • Data analysis
  • Reporting

Penetration Testing Execution Standard

  • Pre-engagement interactions
    • Scope!!!
    • What if we identified something out of the scope?
  • Intelligence gathering
    • Open-Source Intelligence (OSINT): passive | semi-passive | active
  • Threat modeling
    • What-if scenarios
      • What if we lose an asset?
      • What is the asset's net value?
    • What do we need from the organization to do threat modeling?
      • Documentation | assets | threats
  • Vulnerability analysis: Look for flaws
  • Exploitation
    • Establish and gain access
  • Post-exploitation
    • Backdoors that will clean itself
    • Privilege escalation
    • Access to sensitive data
    • DoS - whoops, scope?
  • Reporting
    • Result: improve security, mitigate issues
    • Executive summary
    • Technical report
    • Risk assessment
    • Conclusion, remediation plan

Penetration Testing Methodology by Peter Kim

  • Intelligence Gathering
  • Initial Foothold
  • Local/Network Enumeration
  • Local Privilege Escalation
  • Persistence
  • Lateral Movement
  • Domain Privilege Escalation
  • Dumping Hashes
  • Data Identification/Exfiltration
  • Reporting

Reconnaissance

Do-nots

  • Passwords should never be included in the report, even in a hash form
  • Running binaries/scripts that you have not verified

Study Materials