WTF is Penetration Testing?An Overview of Who, What, Where, When, and WhyScott SutherlandRyan Wakeham
• Scott SutherlandPrinciple Security ConsultantNetSPI• Ryan WakehamDirector of ConsultingNetSPIWho are we?
Presentation Overview• What is a “pen test”?• Why do companies “pen test”?• Who does “pen testing”?• What skills are requi...
What is Penetration Testing?Our Definition:“The process of evaluating systems,applications, and protocols with the intento...
Why do Companies Pen Test?• Compliance Requirements• Validate Existing Controls• Identify Unknown Security Gaps• Prioritiz...
What are the Technical Objectives?• Client specific objectives first• Identify and verify all entry points• Identify criti...
Assessment VS. Penetration• Vulnerability Assessment andPenetration Testing Answer:‒ What are my system layer vulnerabilit...
Assessment VS. Penetration• Penetration Testing Answers:‒ What are my high impact network layer issues?‒ What are my high ...
Common Penetration Test Approach• Kickoff: Scope, cost, testing windows, risks etc• Information Gathering• Vulnerability E...
Who Conducts Pen Testing?• Internal Employees• Security Analyst• Security Consultant• Third Parties• Audit Firms• Security...
Rules of Engagement• Have fun, but…Hack Responsibly!• Written permission• Stay in scope• No DoS• Don’t change major state•...
What Skills are Needed?• Non Technical• Basic Technical• Offensive• Defensive• Common Tools
Non Technical Skillset• Written and Verbal Communications• Emails/phone calls• Report development• Small and large group p...
Basic Technical Skillset• Windows Desktop Administration• Windows Domain Administration• Linux and Unix Administration• Ne...
Offensive and Defensive Knowledge• System enumeration and servicefingerprinting• Linux system exploitation and escalation•...
Common ToolsThere are hundreds of “hacker” tools.Generally, you need to have enoughknowledge to know what tool or tool(s) ...
Common ToolsThat being said…
Common Tools• Knowledge > Tools• Understand the core technologies• Understand the core offensive techniques• Understand th...
Pen Testing as a Career: Common Paths• Internal Paths• Help Desk• IT Support• IT Admin• Security Analyst• Senior Security ...
Pen Testing as a Career: How to Start• Read and learn! – There is no “end”• Tap into the community!• Research and Developm...
BE SAFE andHACK RESPONSIBLY
QuestionsQuestions,comments, curses?
Upcoming SlideShare
Loading in...5
×

WTF is Penetration Testing

594

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
594
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Transcript of "WTF is Penetration Testing"

  1. 1. WTF is Penetration Testing?An Overview of Who, What, Where, When, and WhyScott SutherlandRyan Wakeham
  2. 2. • Scott SutherlandPrinciple Security ConsultantNetSPI• Ryan WakehamDirector of ConsultingNetSPIWho are we?
  3. 3. Presentation Overview• What is a “pen test”?• Why do companies “pen test”?• Who does “pen testing”?• What skills are required?‒ Non Technical Skillset‒ Basic Technical Skillset‒ Offensive and Defensive Knowledge• What are some Common Tools?• Pen Testing as a Career• Attack Demo: SQL Inject World• Questions
  4. 4. What is Penetration Testing?Our Definition:“The process of evaluating systems,applications, and protocols with the intentof identifying vulnerabilities from theperspective of an unprivileged oranonymous user to determine the realworld impact…”“…legally and under contract”
  5. 5. Why do Companies Pen Test?• Compliance Requirements• Validate Existing Controls• Identify Unknown Security Gaps• Prioritize Existing Security Initiatives• Prevent Data Breaches• Test IDS / IPS / IRP
  6. 6. What are the Technical Objectives?• Client specific objectives first• Identify and verify all entry points• Identify critical escalation points• Gain unauthorized access to:‒ Application functionality‒ Critical systems‒ Sensitive data
  7. 7. Assessment VS. Penetration• Vulnerability Assessment andPenetration Testing Answer:‒ What are my system layer vulnerabilities?‒ Where are my system layer vulnerabilities?‒ How wide spread are my system layervulnerabilities?‒ Can I identify attacks?‒ How do I fix my vulnerabilities?
  8. 8. Assessment VS. Penetration• Penetration Testing Answers:‒ What are my high impact network layer issues?‒ What are my high impact application layerissues?‒ Can an attacker gain unauthorized access to:• critical infrastructure that providesprivileged access or cause service disruptions• critical application functionality that thebusiness depends on• sensitive data that the business would berequired to report on if a breach occurs‒ Can an attacker bypass our IPS / WAF?‒ Can an attacker pivot from environment A toenvironment B?
  9. 9. Common Penetration Test Approach• Kickoff: Scope, cost, testing windows, risks etc• Information Gathering• Vulnerability Enumeration• Penetration• Escalation• Evidence Gathering (Pilfering)• Clean up• Report Creation• Report Delivery and Review• Remediation
  10. 10. Who Conducts Pen Testing?• Internal Employees• Security Analyst• Security Consultant• Third Parties• Audit Firms• Security Consultants
  11. 11. Rules of Engagement• Have fun, but…Hack Responsibly!• Written permission• Stay in scope• No DoS• Don’t change major state• Restore state• Clear communication
  12. 12. What Skills are Needed?• Non Technical• Basic Technical• Offensive• Defensive• Common Tools
  13. 13. Non Technical Skillset• Written and Verbal Communications• Emails/phone calls• Report development• Small and large group presentations• Professionalism• Respecting others, setting, andmeeting expectations• Troubleshooting Mindset• Never give up, never surrender• Where there is a will, there is a way• Ethics• Don’t do bad things• Pros (career) vs. Cons (jail)• Hack responsibly
  14. 14. Basic Technical Skillset• Windows Desktop Administration• Windows Domain Administration• Linux and Unix Administration• Network Infrastructure Administration• Application Development• Scripting (Ruby, Python, PHP, Bash, PS, Batch)• Managed languages (.Net, Java, Davlik)• Unmanaged languages (C, C++)
  15. 15. Offensive and Defensive Knowledge• System enumeration and servicefingerprinting• Linux system exploitation and escalation• Windows system exploitation and escalation• Network system exploitation and escalation• Protocol exploitation• Web application exploitation (OWASP)• Reverse engineering client-serverapplications + AV Evasion• Social engineering techniques (onsite,phone, email)
  16. 16. Common ToolsThere are hundreds of “hacker” tools.Generally, you need to have enoughknowledge to know what tool or tool(s) isright for the task at hand….…and if one doesn’t exist, then create it.
  17. 17. Common ToolsThat being said…
  18. 18. Common Tools• Knowledge > Tools• Understand the core technologies• Understand the core offensive techniques• Understand the core defensive techniques• Network Penetration Testing• BT, CAIN, YERSINIA, NCAT, NMAP, NESSUS,NEXPOSE, WCE, MIMIKATZ, AirCrack-ng,METASPLOIT… and NATIVE TOOLS!• Application Penetration Testing• BURP, ZAP, NIKTO, DIRBUSTER, SQLMAP, SQLNinja, and BEEF…. and commercial tools
  19. 19. Pen Testing as a Career: Common Paths• Internal Paths• Help Desk• IT Support• IT Admin• Security Analyst• Senior Security Analyst• Internal Consultant• CISO• Security Consulting Paths• Internship• Consultant• Senior Consultant• Principle Consultant• Team Lead• DirectorSecurity consultantsoften end up inmalware research orexploitdevelopment, butsome go corporate.Internal employeesoften stay internal.
  20. 20. Pen Testing as a Career: How to Start• Read and learn! – There is no “end”• Tap into the community!• Research and Development• Contribute to open source projects• Present research at conferences• Training and Certifications• Community: DC612, OWASP, Conferences, etc• Professional ($): SANS, OffSec, CISSP, etc• Volunteer• Internships
  21. 21. BE SAFE andHACK RESPONSIBLY
  22. 22. QuestionsQuestions,comments, curses?

×