If you were to hired to conduct a strict penetration test for a company how woul
ID: 3731748 • Letter: I
Question
If you were to hired to conduct a strict penetration test for a company how would you answer these briefly? A. What information do we need to gather in order to conduct our penetration test? (Domain names, server names, Internet service provider information, IP addresses of host, number of employees, etc.) B. What types of scanning will we need to perform? (Network Discover, Network survey, Network scanning, etc.) C. What is the general timeframe for performing reconnaissance? (One hour one day, etc.) D. What tools will we need to perform these scans? (Nmap, Nessus, etc.)Explanation / Answer
Penetration test is a method to identify vulnerabilities that exists in a system or network which is already secured. A penetration test is conducted by attacking methods by trusted individuals that are similarly used by intruders or hackers
A)
IP Address
What operating systems are running on a network.
Domain names, server names, Internet service provider information, IP addresses of hosts involved as well as a network map.
Domain registry information for the servers.
The type of packet filters/firewalls in use
System information like the operating system
List of open ports on a particular IP addresses
There are 6 phases for penetration testing
Information gathering
Scanning
Fingerprinting
Vulnerability Scanning
Exploit Verification
Reports
B)
For information gathering, network survey is performed. This will provide pentesters with domain and server names, the range of IP addresses owned by the organization, information about closed and open network ports, running OS and services.
In vulnerability scan pentesters scan the network looking for vulnerabilities to use for a penetration attempt. Vulnerability scanning can be automated and manual..
C)
Reconnaissance is used to gather as much information about the target network as possible.
Examples for information sources are search engines, social networks, WHOIS databases or the Domain Name System (DNS).
It may take one hour, one day etc depending on the user’s need.
D)
Information Gathering:
Nmap – Network scanning, port scanning and OS detection
hping – Tool for port scanning.
netcat - Grabs service banners / versions.
firewalk - Determining firewall ACLs.
ethereal - Monitoring and logging return traffic from maps and scans.
icmpquery - Determining target system time and netmask.
strobe - Port scanning utility
Vulnerability Detection:
Nessus - Scans for vulnerabilities.
SARA – Another scanner to scan for vulnerabilities.
Penetration Tools:
Brutus – Telnet, FTP and HTTP Password cracker
LC3 – Password cracking utility