SlideShare a Scribd company logo

Pen test methodology

•
•
Cahyo Darujati
Cahyo Darujati

This document outlines the methodology for performing a penetration test in three phases: planning and preparation, assessment, and reporting. The planning phase involves setting scope and contacts. The assessment phase consists of information gathering, network mapping, vulnerability identification, penetration testing, privilege escalation, and maintaining access. The final phase covers reporting findings, cleanup, and destroying artifacts. The goal is to find security vulnerabilities before attackers do.

Education
1 of 24
PENETRATION TESTING METHODOLOGY Ver. 1.0 Cahyo Darujati, MT. Open Information Systems Security Group
REQUEST A PENETRATION TEST QUOTE ● Find Holes Now Before Somebody Else Does :-p ● FREE Consultation. ● +62-8123-594969 (SMS ONLY) Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 2
Quote ● Security is a process not a product (Bruce Schneier) Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 3
CONTENTS What is Pen-Testing? Why perfoms Pen-testing? PHASE – I: PLANNING AND PREPARATION PHASE – II: ASSESSMENT PHASE – III: REPORTING, CLEAN UP & DESTROY ARTIFACTS Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 4
What is Pen-Testing? ● Penetration testing is the process of attempting to gain access to resources without knowledge of usernames, passwords and other normal means of access. If the focus is on computer resources, then examples of a successful penetration would be obtaining or subverting confidential documents, pricelists, databases and other protected information. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 5
Why perfoms Pen-testing? ● There are a variety of reasons for performing a penetration test. One of the main reasons is to find vulnerabilities and fix them before an attacker does. Sometimes, the IT department is aware of reported vulnerabilities but they need an outside expert to officially report them so that management will approve the resources necessary to fix them. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 6
PHASE – I PLANNING AND PREPARATION Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 7
PLANNING AND PREPARATION (a) Identification of contact individuals from both side, (b) Opening meting to confirm the scope, approach and methodology, and (c) Agree to specific test cases and escalation paths Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 8
PHASE – II ASSESSMENT Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 9
ASSESSMENT 1.Information Gathering 2.Network Mapping 3.Vulnerability Identification 4.Penetration 5.Gaining Access & Privilege Escalation 6.Enumerating Further 7.Compromise Remote Users/Sites 8.Maintaining Access 9.Covering Tracks Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 10
1.Information Gathering Essentially using the Internet to find all the information you can about the target (company and/or person) using both technical (DNS/WHOIS) and non-technical (search engines, news groups, mailing lists etc) methods. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 11
2.Network Mapping Many tools and applications can be used in this stage to aid the discovery of technical information about the hosts and networks involved in the test. ·Find live hosts ·Port and service scanning ·Perimeter network mapping (router, firewalls) ·Identifying critical services ·Operating System fingerprinting ·Identifying routes using Management Information Base (MIB) ·Service fingerprinting Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 12
3.Vulnerability Identification The assessor will perform several activities to detect exploitable weak points. These activities include: 1. Identify vulnerable services using service banners 2. Perform vulnerability scan to search for known vulnerabilities. 3. Perform false positive and false negative verification 4. Enumerate discovered vulnerabilities 5. Estimate probable impact (classify vulnerabilities found) 6. Identify attack paths and scenarios for exploitation Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 13
4.Penetration 1.Find proof of concept code/tool 2.Develop tools/scripts 3.Test proof of concept code/tool 4.Customize proof of concept code/tool 5.Test proof of concept code/tool in an isolated environment 6.Use proof of concept code against target 7.The proof of concept code/tool is used against the target to gain as many points of unauthorized access as possible. 8.Verify or disprove the existence of vulnerabilities Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 14
5.Gaining Access & Privilege Escalation 5.1 Gaining Access 5.1.1 Gain Least Privilege 5.1.2 Compromise 5.1.3 Final Compromise on Target 5.2 Privilege Escalation Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 15
6.Enumerating Further 1.Obtain encrypted passwords for offline cracking 2.Obtain password (plaintext or encrypted) by using sniffing or other techniques 3.Sniff traffic and analyze it 4.Gather cookies and use them to exploit sessions and for password attacks 5.E-mail address gathering 6.Identifying routes and networks 7.Mapping internal networks Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 16
7.Compromise Remote Users/Sites A single hole is sufficient to expose an entire network, regardless of how secure the perimeter network may be. Any system is as strong (in this case, as secure) as the weakest of its parts. Communications between remote users/sites and enterprise networks may be provided with authentication and encryption by using technologies such as VPN, to ensure that the data in transit over the network cannot be faked nor eavesdropped. In such scenarios the assessor should try to compromise remote users, telecommuter and/or remote sites of an enterprise. Those can give privileged access to internal network. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 17
8.Maintaining Access 8.1 Covert Channels 8.2 Backdoors 8.3 Root-kits Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 18
9.Covering Tracks 9.1 Hide Files 9.2 Clear Logs 9.3 Defeat integrity checking 9.4 Defeat Anti-virus 9.5 Implement Root-kits Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 19
PHASE – III REPORTING, CLEAN UP & DESTROY ARTIFACTS Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 20
REPORTING, CLEAN UP & DESTROY ARTIFACTS 3.1 Reporting 3.1.1 Verbal Reporting 3.1.2 Final Reporting 3.2 Clean Up and Destroy Artifacts Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 21
REQUEST A PENETRATION TEST QUOTE ● Find Holes Now Before Somebody Else Does :-p ● FREE Consultation. ● +62-8123-594969 (SMS ONLY) Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 22
References http://www.oissg.org/ http://www.schneier.com/ http://www.sans.org/ Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 23
History Ver 1.0 : Nov 13, 2012. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 24

Recommended

Penetration testing reporting and methodology
Penetration testing reporting and methodologyPenetration testing reporting and methodology
Penetration testing reporting and methodologyRashad Aliyev
 
Web Application Security and Awareness
Web Application Security and AwarenessWeb Application Security and Awareness
Web Application Security and AwarenessAbdul Rahman Sherzad
 
Vulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskVulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskAlienVault
 
Application Security
Application SecurityApplication Security
Application SecurityReggie Niccolo Santos
 
VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing Netpluz Asia Pte Ltd
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
Security Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsSecurity Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsYulian Slobodyan
 
7 Steps to Threat Modeling
7 Steps to Threat Modeling7 Steps to Threat Modeling
7 Steps to Threat ModelingDanny Wong
 

Recommended

Penetration testing reporting and methodology
Penetration testing reporting and methodologyPenetration testing reporting and methodology
Penetration testing reporting and methodologyRashad Aliyev
 
Web Application Security and Awareness
Web Application Security and AwarenessWeb Application Security and Awareness
Web Application Security and AwarenessAbdul Rahman Sherzad
 
Vulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskVulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskAlienVault
 
Application Security
Application SecurityApplication Security
Application SecurityReggie Niccolo Santos
 
VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing Netpluz Asia Pte Ltd
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
Security Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsSecurity Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsYulian Slobodyan
 
7 Steps to Threat Modeling
7 Steps to Threat Modeling7 Steps to Threat Modeling
7 Steps to Threat ModelingDanny Wong
 
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingAnurag Srivastava
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsMark Arena
 
Secure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsSecure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsEoin Woods
 
Threat Modelling
Threat ModellingThreat Modelling
Threat Modellingn|u - The Open Security Community
 
IT Security management and risk assessment
IT Security management and risk assessmentIT Security management and risk assessment
IT Security management and risk assessmentCAS
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghOWASP Delhi
 
Cyber security awareness
Cyber security awarenessCyber security awareness
Cyber security awarenessJason Murray
 
Threat Modeling And Analysis
Threat Modeling And AnalysisThreat Modeling And Analysis
Threat Modeling And AnalysisLalit Kale
 
CISSP Prep: Ch 8. Security Operations
CISSP Prep: Ch 8. Security OperationsCISSP Prep: Ch 8. Security Operations
CISSP Prep: Ch 8. Security OperationsSam Bowne
 
Secure Coding and Threat Modeling
Secure Coding and Threat ModelingSecure Coding and Threat Modeling
Secure Coding and Threat ModelingMiriam Celi, CISSP, GISP, MSCS, MBA
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDEGirindro Pringgo Digdo
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainSuvrat Jain
 
Cyber Threat Modeling
Cyber Threat ModelingCyber Threat Modeling
Cyber Threat ModelingEC-Council
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceAndreas Sfakianakis
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Managementasherad
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 
Metasploit framwork
Metasploit framworkMetasploit framwork
Metasploit framworkDeepanshu Gajbhiye
 
Vulnerability Assessment Report
Vulnerability Assessment ReportVulnerability Assessment Report
Vulnerability Assessment ReportHarshit Singh Bhatia
 
Security testing
Security testingSecurity testing
Security testingKhizra Sammad
 
Secure Code Review 101
Secure Code Review 101Secure Code Review 101
Secure Code Review 101Narudom Roongsiriwong, CISSP
 
Mengatur referensi penelitian
Mengatur referensi penelitianMengatur referensi penelitian
Mengatur referensi penelitianCahyo Darujati
 
01.welcome.ppt.sosialisasi.skkni.surabaya
01.welcome.ppt.sosialisasi.skkni.surabaya01.welcome.ppt.sosialisasi.skkni.surabaya
01.welcome.ppt.sosialisasi.skkni.surabayaCahyo Darujati
 

More Related Content

What's hot

Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingAnurag Srivastava
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsMark Arena
 
Secure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsSecure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsEoin Woods
 
IT Security management and risk assessment
IT Security management and risk assessmentIT Security management and risk assessment
IT Security management and risk assessmentCAS
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghOWASP Delhi
 
Cyber security awareness
Cyber security awarenessCyber security awareness
Cyber security awarenessJason Murray
 
Threat Modeling And Analysis
Threat Modeling And AnalysisThreat Modeling And Analysis
Threat Modeling And AnalysisLalit Kale
 
CISSP Prep: Ch 8. Security Operations
CISSP Prep: Ch 8. Security OperationsCISSP Prep: Ch 8. Security Operations
CISSP Prep: Ch 8. Security OperationsSam Bowne
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainSuvrat Jain
 
Cyber Threat Modeling
Cyber Threat ModelingCyber Threat Modeling
Cyber Threat ModelingEC-Council
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceAndreas Sfakianakis
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Managementasherad
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 

What's hot (20)

Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration Testing
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
 
Secure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of UsSecure by Design - Security Design Principles for the Rest of Us
Secure by Design - Security Design Principles for the Rest of Us
 
Threat Modelling
Threat ModellingThreat Modelling
Threat Modelling
 
IT Security management and risk assessment
IT Security management and risk assessmentIT Security management and risk assessment
IT Security management and risk assessment
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
Cyber security awareness
Cyber security awarenessCyber security awareness
Cyber security awareness
 
Threat Modeling And Analysis
Threat Modeling And AnalysisThreat Modeling And Analysis
Threat Modeling And Analysis
 
CISSP Prep: Ch 8. Security Operations
CISSP Prep: Ch 8. Security OperationsCISSP Prep: Ch 8. Security Operations
CISSP Prep: Ch 8. Security Operations
 
Secure Coding and Threat Modeling
Secure Coding and Threat ModelingSecure Coding and Threat Modeling
Secure Coding and Threat Modeling
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDE
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jain
 
Cyber Threat Modeling
Cyber Threat ModelingCyber Threat Modeling
Cyber Threat Modeling
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on it
 
Metasploit framwork
Metasploit framworkMetasploit framwork
Metasploit framwork
 
Vulnerability Assessment Report
Vulnerability Assessment ReportVulnerability Assessment Report
Vulnerability Assessment Report
 
Security testing
Security testingSecurity testing
Security testing
 
Secure Code Review 101
Secure Code Review 101Secure Code Review 101
Secure Code Review 101
 

Viewers also liked

Mengatur referensi penelitian
Mengatur referensi penelitianMengatur referensi penelitian
Mengatur referensi penelitianCahyo Darujati
 
01.welcome.ppt.sosialisasi.skkni.surabaya
01.welcome.ppt.sosialisasi.skkni.surabaya01.welcome.ppt.sosialisasi.skkni.surabaya
01.welcome.ppt.sosialisasi.skkni.surabayaCahyo Darujati
 
Tatakelola Teknologi Informasi
Tatakelola Teknologi InformasiTatakelola Teknologi Informasi
Tatakelola Teknologi InformasiCahyo Darujati
 
Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01Cahyo Darujati
 
Kbk436 Sistem Operasi Lanjut Lecture02
Kbk436 Sistem Operasi Lanjut Lecture02Kbk436 Sistem Operasi Lanjut Lecture02
Kbk436 Sistem Operasi Lanjut Lecture02Cahyo Darujati
 
IT Governance Presentation
IT Governance PresentationIT Governance Presentation
IT Governance Presentationjmcarden
 
Journeys in it governance v2
Journeys in it governance v2Journeys in it governance v2
Journeys in it governance v2Ben Perry
 
Penetration Security Testing
Penetration Security TestingPenetration Security Testing
Penetration Security TestingSanjulika Rastogi
 
Emerging Role Of Cio As A Strategy Execution Officer
Emerging Role Of Cio As A Strategy Execution OfficerEmerging Role Of Cio As A Strategy Execution Officer
Emerging Role Of Cio As A Strategy Execution OfficerBalaji Balasubramanian
 
Penetration testing the cloud - vlad gostom
Penetration testing the cloud - vlad gostomPenetration testing the cloud - vlad gostom
Penetration testing the cloud - vlad gostomHardway Hou
 

Viewers also liked (20)

Mengatur referensi penelitian
Mengatur referensi penelitianMengatur referensi penelitian
Mengatur referensi penelitian
 
01.welcome.ppt.sosialisasi.skkni.surabaya
01.welcome.ppt.sosialisasi.skkni.surabaya01.welcome.ppt.sosialisasi.skkni.surabaya
01.welcome.ppt.sosialisasi.skkni.surabaya
 
Tatakelola Teknologi Informasi
Tatakelola Teknologi InformasiTatakelola Teknologi Informasi
Tatakelola Teknologi Informasi
 
Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01
 
pengenalan ipv6
pengenalan ipv6pengenalan ipv6
pengenalan ipv6
 
Kbk436 Sistem Operasi Lanjut Lecture02
Kbk436 Sistem Operasi Lanjut Lecture02Kbk436 Sistem Operasi Lanjut Lecture02
Kbk436 Sistem Operasi Lanjut Lecture02
 
Stateofthecio2008 1210987739793979 8
Stateofthecio2008 1210987739793979 8Stateofthecio2008 1210987739793979 8
Stateofthecio2008 1210987739793979 8
 
Walsham 2006 Summary (Team 6) V0.2[1]
Walsham 2006 Summary (Team 6) V0.2[1]Walsham 2006 Summary (Team 6) V0.2[1]
Walsham 2006 Summary (Team 6) V0.2[1]
 
Ibm Cio 2010 Outlook
Ibm Cio 2010 OutlookIbm Cio 2010 Outlook
Ibm Cio 2010 Outlook
 
Child Wear Ea Blueprint V0.7
Child Wear Ea Blueprint V0.7Child Wear Ea Blueprint V0.7
Child Wear Ea Blueprint V0.7
 
Strategy Execution Officer
Strategy Execution OfficerStrategy Execution Officer
Strategy Execution Officer
 
Stateofthecio2008 1210987739793979 8
Stateofthecio2008 1210987739793979 8Stateofthecio2008 1210987739793979 8
Stateofthecio2008 1210987739793979 8
 
IT Governance Presentation
IT Governance PresentationIT Governance Presentation
IT Governance Presentation
 
Journeys in it governance v2
Journeys in it governance v2Journeys in it governance v2
Journeys in it governance v2
 
COBIT 5
COBIT 5COBIT 5
COBIT 5
 
Isrc Architectingfor Agility J.Ross
Isrc Architectingfor Agility J.RossIsrc Architectingfor Agility J.Ross
Isrc Architectingfor Agility J.Ross
 
Penetration Security Testing
Penetration Security TestingPenetration Security Testing
Penetration Security Testing
 
Emerging Role Of Cio As A Strategy Execution Officer
Emerging Role Of Cio As A Strategy Execution OfficerEmerging Role Of Cio As A Strategy Execution Officer
Emerging Role Of Cio As A Strategy Execution Officer
 
Penetration testing the cloud - vlad gostom
Penetration testing the cloud - vlad gostomPenetration testing the cloud - vlad gostom
Penetration testing the cloud - vlad gostom
 
Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0
 

Similar to Pen test methodology

Security protection On banking systems using ethical hacking.
Security protection On banking systems using ethical hacking.Security protection On banking systems using ethical hacking.
Security protection On banking systems using ethical hacking.Rishabh Gupta
 
Itis pentest slides hyd
Itis pentest slides hydItis pentest slides hyd
Itis pentest slides hydRama krishna
 
Network Security_4th Module_Dr. Shivashankar
Network Security_4th Module_Dr. ShivashankarNetwork Security_4th Module_Dr. Shivashankar
Network Security_4th Module_Dr. ShivashankarDr. Shivashankar
 
Web application development_dos_and_donts
Web application development_dos_and_dontsWeb application development_dos_and_donts
Web application development_dos_and_dontshuynhvanphuc
 
3.Seminar Report Ashar Shaikh Final.docx
3.Seminar Report Ashar Shaikh Final.docx3.Seminar Report Ashar Shaikh Final.docx
3.Seminar Report Ashar Shaikh Final.docxasharshaikh8
 
Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report Rishabh Upadhyay
 
Internal penetration test_hitchhackers_guide
Internal penetration test_hitchhackers_guideInternal penetration test_hitchhackers_guide
Internal penetration test_hitchhackers_guideDarin Fredde
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chanceDr. Anish Cheriyan (PhD)
 
IRJET-Ethical Hacking
IRJET-Ethical HackingIRJET-Ethical Hacking
IRJET-Ethical HackingIRJET Journal
 
Mitre ATTACK and the North Korean Regime-Backed Programmer
Mitre ATTACK and the North Korean Regime-Backed ProgrammerMitre ATTACK and the North Korean Regime-Backed Programmer
Mitre ATTACK and the North Korean Regime-Backed ProgrammerDigital Shadows
 
An overview of network penetration testing
An overview of network penetration testingAn overview of network penetration testing
An overview of network penetration testingeSAT Publishing House
 
Bug Bounty Guide Tools and Resource.pdf
Bug Bounty Guide Tools and Resource.pdfBug Bounty Guide Tools and Resource.pdf
Bug Bounty Guide Tools and Resource.pdfhacktube5
 
UMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docx
UMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docxUMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docx
UMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docxwillcoxjanay
 
Certified Ethical Hacking - Book Summary
Certified Ethical Hacking - Book SummaryCertified Ethical Hacking - Book Summary
Certified Ethical Hacking - Book Summaryudemy course
 
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxINTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxSuhailShaik16
 
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...Marcin Ludwiszewski
 

Similar to Pen test methodology (20)

Security protection On banking systems using ethical hacking.
Security protection On banking systems using ethical hacking.Security protection On banking systems using ethical hacking.
Security protection On banking systems using ethical hacking.
 
Itis pentest slides hyd
Itis pentest slides hydItis pentest slides hyd
Itis pentest slides hyd
 
Network Security_4th Module_Dr. Shivashankar
Network Security_4th Module_Dr. ShivashankarNetwork Security_4th Module_Dr. Shivashankar
Network Security_4th Module_Dr. Shivashankar
 
Web application development_dos_and_donts
Web application development_dos_and_dontsWeb application development_dos_and_donts
Web application development_dos_and_donts
 
3.Seminar Report Ashar Shaikh Final.docx
3.Seminar Report Ashar Shaikh Final.docx3.Seminar Report Ashar Shaikh Final.docx
3.Seminar Report Ashar Shaikh Final.docx
 
Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report
 
Internal penetration test_hitchhackers_guide
Internal penetration test_hitchhackers_guideInternal penetration test_hitchhackers_guide
Internal penetration test_hitchhackers_guide
 
3D Password
3D Password3D Password
3D Password
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chance
 
IRJET-Ethical Hacking
IRJET-Ethical HackingIRJET-Ethical Hacking
IRJET-Ethical Hacking
 
Mitre ATTACK and the North Korean Regime-Backed Programmer
Mitre ATTACK and the North Korean Regime-Backed ProgrammerMitre ATTACK and the North Korean Regime-Backed Programmer
Mitre ATTACK and the North Korean Regime-Backed Programmer
 
An overview of network penetration testing
An overview of network penetration testingAn overview of network penetration testing
An overview of network penetration testing
 
Bug Bounty Guide Tools and Resource.pdf
Bug Bounty Guide Tools and Resource.pdfBug Bounty Guide Tools and Resource.pdf
Bug Bounty Guide Tools and Resource.pdf
 
UMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docx
UMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docxUMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docx
UMUC Monitoring, Auditing, Intrusion Detection, Intrusion Prev.docx
 
Security audit
Security auditSecurity audit
Security audit
 
Path of Cyber Security
Path of Cyber SecurityPath of Cyber Security
Path of Cyber Security
 
Path of Cyber Security
Path of Cyber SecurityPath of Cyber Security
Path of Cyber Security
 
Certified Ethical Hacking - Book Summary
Certified Ethical Hacking - Book SummaryCertified Ethical Hacking - Book Summary
Certified Ethical Hacking - Book Summary
 
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxINTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
 
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
 

More from Cahyo Darujati

Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2
Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2
Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2Cahyo Darujati
 
Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...
Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...
Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...Cahyo Darujati
 
Melawan penyebaran hoax di media sosial dengan teknologi
Melawan penyebaran hoax di media sosial dengan teknologiMelawan penyebaran hoax di media sosial dengan teknologi
Melawan penyebaran hoax di media sosial dengan teknologiCahyo Darujati
 
Security is a process not a magic
Security is a process not a magicSecurity is a process not a magic
Security is a process not a magicCahyo Darujati
 
Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01Cahyo Darujati
 
Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01Cahyo Darujati
 
Kcd226 Sistem Operasi Lecture06
Kcd226 Sistem Operasi Lecture06Kcd226 Sistem Operasi Lecture06
Kcd226 Sistem Operasi Lecture06Cahyo Darujati
 
Kcd226 Sistem Operasi Lecture05
Kcd226 Sistem Operasi Lecture05Kcd226 Sistem Operasi Lecture05
Kcd226 Sistem Operasi Lecture05Cahyo Darujati
 
Kcd226 Sistem Operasi Lecture04
Kcd226 Sistem Operasi Lecture04Kcd226 Sistem Operasi Lecture04
Kcd226 Sistem Operasi Lecture04Cahyo Darujati
 
Kcd226 Sistem Operasi Lecture03
Kcd226 Sistem Operasi Lecture03Kcd226 Sistem Operasi Lecture03
Kcd226 Sistem Operasi Lecture03Cahyo Darujati
 
Kcd226 Sistem Operasi Lecture02
Kcd226 Sistem Operasi Lecture02Kcd226 Sistem Operasi Lecture02
Kcd226 Sistem Operasi Lecture02Cahyo Darujati
 
Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01Cahyo Darujati
 

More from Cahyo Darujati (12)

Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2
Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2
Presentasi jaring pengaman sandi untuk mendukung spbe 29042019 rev2
 
Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...
Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...
Melindungi, Mengamankan, Menanggulangi, dan Memulihkan Keamanan Informasi Pen...
 
Melawan penyebaran hoax di media sosial dengan teknologi
Melawan penyebaran hoax di media sosial dengan teknologiMelawan penyebaran hoax di media sosial dengan teknologi
Melawan penyebaran hoax di media sosial dengan teknologi
 
Security is a process not a magic
Security is a process not a magicSecurity is a process not a magic
Security is a process not a magic
 
Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01
 
Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01Kcd226 Sistem Operasi Lecture01
Kcd226 Sistem Operasi Lecture01
 
Kcd226 Sistem Operasi Lecture06
Kcd226 Sistem Operasi Lecture06Kcd226 Sistem Operasi Lecture06
Kcd226 Sistem Operasi Lecture06
 
Kcd226 Sistem Operasi Lecture05
Kcd226 Sistem Operasi Lecture05Kcd226 Sistem Operasi Lecture05
Kcd226 Sistem Operasi Lecture05
 
Kcd226 Sistem Operasi Lecture04
Kcd226 Sistem Operasi Lecture04Kcd226 Sistem Operasi Lecture04
Kcd226 Sistem Operasi Lecture04
 
Kcd226 Sistem Operasi Lecture03
Kcd226 Sistem Operasi Lecture03Kcd226 Sistem Operasi Lecture03
Kcd226 Sistem Operasi Lecture03
 
Kcd226 Sistem Operasi Lecture02
Kcd226 Sistem Operasi Lecture02Kcd226 Sistem Operasi Lecture02
Kcd226 Sistem Operasi Lecture02
 
Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01Kbk436 Sistem Operasi Lanjut Lecture01
Kbk436 Sistem Operasi Lanjut Lecture01
 

Recently uploaded

[GDSC YCCE] Build with AI Online Presentation
[GDSC YCCE] Build with AI Online Presentation[GDSC YCCE] Build with AI Online Presentation
[GDSC YCCE] Build with AI Online PresentationGDSCYCCE
 
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptxSolid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptxDenish Jangid
 
Home assignment II on Spectroscopy 2024 Answers.pdf
Home assignment II on Spectroscopy 2024 Answers.pdfHome assignment II on Spectroscopy 2024 Answers.pdf
Home assignment II on Spectroscopy 2024 Answers.pdfTamralipta Mahavidyalaya
 
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdfINU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdfbu07226
 
Fish and Chips - have they had their chips
Fish and Chips - have they had their chipsFish and Chips - have they had their chips
Fish and Chips - have they had their chipsGeoBlogs
 
Basic phrases for greeting and assisting costumers
Basic phrases for greeting and assisting costumersBasic phrases for greeting and assisting costumers
Basic phrases for greeting and assisting costumersPedroFerreira53928
 
MARUTI SUZUKI- A Successful Joint Venture in India.pptx
MARUTI SUZUKI- A Successful Joint Venture in India.pptxMARUTI SUZUKI- A Successful Joint Venture in India.pptx
MARUTI SUZUKI- A Successful Joint Venture in India.pptxbennyroshan06
 
Additional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdfAdditional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdfjoachimlavalley1
 
The Benefits and Challenges of Open Educational Resources
The Benefits and Challenges of Open Educational ResourcesThe Benefits and Challenges of Open Educational Resources
The Benefits and Challenges of Open Educational Resourcesaileywriter
 
Industrial Training Report- AKTU Industrial Training Report
Industrial Training Report- AKTU Industrial Training ReportIndustrial Training Report- AKTU Industrial Training Report
Industrial Training Report- AKTU Industrial Training ReportAvinash Rai
 
Salient features of Environment protection Act 1986.pptx
Salient features of Environment protection Act 1986.pptxSalient features of Environment protection Act 1986.pptx
Salient features of Environment protection Act 1986.pptxakshayaramakrishnan21
 
Synthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptxSynthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptxPavel ( NSTU)
 
Basic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
Basic Civil Engg Notes_Chapter-6_Environment Pollution & EngineeringBasic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
Basic Civil Engg Notes_Chapter-6_Environment Pollution & EngineeringDenish Jangid
 
Palestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptxPalestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptxRaedMohamed3
 
50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...
50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...
50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...Nguyen Thanh Tu Collection
 
Application of Matrices in real life. Presentation on application of matrices
Application of Matrices in real life. Presentation on application of matricesApplication of Matrices in real life. Presentation on application of matrices
Application of Matrices in real life. Presentation on application of matricesRased Khan
 
Benefits and Challenges of Using Open Educational Resources
Benefits and Challenges of Using Open Educational ResourcesBenefits and Challenges of Using Open Educational Resources
Benefits and Challenges of Using Open Educational Resourcesdimpy50
 
slides CapTechTalks Webinar May 2024 Alexander Perry.pptx
slides CapTechTalks Webinar May 2024 Alexander Perry.pptxslides CapTechTalks Webinar May 2024 Alexander Perry.pptx
slides CapTechTalks Webinar May 2024 Alexander Perry.pptxCapitolTechU
 

Recently uploaded (20)

[GDSC YCCE] Build with AI Online Presentation
[GDSC YCCE] Build with AI Online Presentation[GDSC YCCE] Build with AI Online Presentation
[GDSC YCCE] Build with AI Online Presentation
 
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptxSolid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
 
Home assignment II on Spectroscopy 2024 Answers.pdf
Home assignment II on Spectroscopy 2024 Answers.pdfHome assignment II on Spectroscopy 2024 Answers.pdf
Home assignment II on Spectroscopy 2024 Answers.pdf
 
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdfINU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
 
Fish and Chips - have they had their chips
Fish and Chips - have they had their chipsFish and Chips - have they had their chips
Fish and Chips - have they had their chips
 
Basic phrases for greeting and assisting costumers
Basic phrases for greeting and assisting costumersBasic phrases for greeting and assisting costumers
Basic phrases for greeting and assisting costumers
 
MARUTI SUZUKI- A Successful Joint Venture in India.pptx
MARUTI SUZUKI- A Successful Joint Venture in India.pptxMARUTI SUZUKI- A Successful Joint Venture in India.pptx
MARUTI SUZUKI- A Successful Joint Venture in India.pptx
 
Additional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdfAdditional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdf
 
NCERT Solutions Power Sharing Class 10 Notes pdf
NCERT Solutions Power Sharing Class 10 Notes pdfNCERT Solutions Power Sharing Class 10 Notes pdf
NCERT Solutions Power Sharing Class 10 Notes pdf
 
The Benefits and Challenges of Open Educational Resources
The Benefits and Challenges of Open Educational ResourcesThe Benefits and Challenges of Open Educational Resources
The Benefits and Challenges of Open Educational Resources
 
Industrial Training Report- AKTU Industrial Training Report
Industrial Training Report- AKTU Industrial Training ReportIndustrial Training Report- AKTU Industrial Training Report
Industrial Training Report- AKTU Industrial Training Report
 
Salient features of Environment protection Act 1986.pptx
Salient features of Environment protection Act 1986.pptxSalient features of Environment protection Act 1986.pptx
Salient features of Environment protection Act 1986.pptx
 
Synthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptxSynthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptx
 
Basic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
Basic Civil Engg Notes_Chapter-6_Environment Pollution & EngineeringBasic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
Basic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
 
Palestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptxPalestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptx
 
B.ed spl. HI pdusu exam paper-2023-24.pdf
B.ed spl. HI pdusu exam paper-2023-24.pdfB.ed spl. HI pdusu exam paper-2023-24.pdf
B.ed spl. HI pdusu exam paper-2023-24.pdf
 
50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...
50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...
50 ĐỀ LUYỆN THI IOE LỚP 9 - NĂM HỌC 2022-2023 (CÓ LINK HÌNH, FILE AUDIO VÀ ĐÁ...
 
Application of Matrices in real life. Presentation on application of matrices
Application of Matrices in real life. Presentation on application of matricesApplication of Matrices in real life. Presentation on application of matrices
Application of Matrices in real life. Presentation on application of matrices
 
Benefits and Challenges of Using Open Educational Resources
Benefits and Challenges of Using Open Educational ResourcesBenefits and Challenges of Using Open Educational Resources
Benefits and Challenges of Using Open Educational Resources
 
slides CapTechTalks Webinar May 2024 Alexander Perry.pptx
slides CapTechTalks Webinar May 2024 Alexander Perry.pptxslides CapTechTalks Webinar May 2024 Alexander Perry.pptx
slides CapTechTalks Webinar May 2024 Alexander Perry.pptx
 

Pen test methodology

  • 1. PENETRATION TESTING METHODOLOGY Ver. 1.0 Cahyo Darujati, MT. Open Information Systems Security Group
  • 2. REQUEST A PENETRATION TEST QUOTE ● Find Holes Now Before Somebody Else Does :-p ● FREE Consultation. ● +62-8123-594969 (SMS ONLY) Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 2
  • 3. Quote ● Security is a process not a product (Bruce Schneier) Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 3
  • 4. CONTENTS What is Pen-Testing? Why perfoms Pen-testing? PHASE – I: PLANNING AND PREPARATION PHASE – II: ASSESSMENT PHASE – III: REPORTING, CLEAN UP & DESTROY ARTIFACTS Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 4
  • 5. What is Pen-Testing? ● Penetration testing is the process of attempting to gain access to resources without knowledge of usernames, passwords and other normal means of access. If the focus is on computer resources, then examples of a successful penetration would be obtaining or subverting confidential documents, pricelists, databases and other protected information. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 5
  • 6. Why perfoms Pen-testing? ● There are a variety of reasons for performing a penetration test. One of the main reasons is to find vulnerabilities and fix them before an attacker does. Sometimes, the IT department is aware of reported vulnerabilities but they need an outside expert to officially report them so that management will approve the resources necessary to fix them. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 6
  • 7. PHASE – I PLANNING AND PREPARATION Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 7
  • 8. PLANNING AND PREPARATION (a) Identification of contact individuals from both side, (b) Opening meting to confirm the scope, approach and methodology, and (c) Agree to specific test cases and escalation paths Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 8
  • 9. PHASE – II ASSESSMENT Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 9
  • 10. ASSESSMENT 1.Information Gathering 2.Network Mapping 3.Vulnerability Identification 4.Penetration 5.Gaining Access & Privilege Escalation 6.Enumerating Further 7.Compromise Remote Users/Sites 8.Maintaining Access 9.Covering Tracks Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 10
  • 11. 1.Information Gathering Essentially using the Internet to find all the information you can about the target (company and/or person) using both technical (DNS/WHOIS) and non-technical (search engines, news groups, mailing lists etc) methods. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 11
  • 12. 2.Network Mapping Many tools and applications can be used in this stage to aid the discovery of technical information about the hosts and networks involved in the test. ·Find live hosts ·Port and service scanning ·Perimeter network mapping (router, firewalls) ·Identifying critical services ·Operating System fingerprinting ·Identifying routes using Management Information Base (MIB) ·Service fingerprinting Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 12
  • 13. 3.Vulnerability Identification The assessor will perform several activities to detect exploitable weak points. These activities include: 1. Identify vulnerable services using service banners 2. Perform vulnerability scan to search for known vulnerabilities. 3. Perform false positive and false negative verification 4. Enumerate discovered vulnerabilities 5. Estimate probable impact (classify vulnerabilities found) 6. Identify attack paths and scenarios for exploitation Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 13
  • 14. 4.Penetration 1.Find proof of concept code/tool 2.Develop tools/scripts 3.Test proof of concept code/tool 4.Customize proof of concept code/tool 5.Test proof of concept code/tool in an isolated environment 6.Use proof of concept code against target 7.The proof of concept code/tool is used against the target to gain as many points of unauthorized access as possible. 8.Verify or disprove the existence of vulnerabilities Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 14
  • 15. 5.Gaining Access & Privilege Escalation 5.1 Gaining Access 5.1.1 Gain Least Privilege 5.1.2 Compromise 5.1.3 Final Compromise on Target 5.2 Privilege Escalation Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 15
  • 16. 6.Enumerating Further 1.Obtain encrypted passwords for offline cracking 2.Obtain password (plaintext or encrypted) by using sniffing or other techniques 3.Sniff traffic and analyze it 4.Gather cookies and use them to exploit sessions and for password attacks 5.E-mail address gathering 6.Identifying routes and networks 7.Mapping internal networks Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 16
  • 17. 7.Compromise Remote Users/Sites A single hole is sufficient to expose an entire network, regardless of how secure the perimeter network may be. Any system is as strong (in this case, as secure) as the weakest of its parts. Communications between remote users/sites and enterprise networks may be provided with authentication and encryption by using technologies such as VPN, to ensure that the data in transit over the network cannot be faked nor eavesdropped. In such scenarios the assessor should try to compromise remote users, telecommuter and/or remote sites of an enterprise. Those can give privileged access to internal network. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 17
  • 18. 8.Maintaining Access 8.1 Covert Channels 8.2 Backdoors 8.3 Root-kits Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 18
  • 19. 9.Covering Tracks 9.1 Hide Files 9.2 Clear Logs 9.3 Defeat integrity checking 9.4 Defeat Anti-virus 9.5 Implement Root-kits Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 19
  • 20. PHASE – III REPORTING, CLEAN UP & DESTROY ARTIFACTS Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 20
  • 21. REPORTING, CLEAN UP & DESTROY ARTIFACTS 3.1 Reporting 3.1.1 Verbal Reporting 3.1.2 Final Reporting 3.2 Clean Up and Destroy Artifacts Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 21
  • 22. REQUEST A PENETRATION TEST QUOTE ● Find Holes Now Before Somebody Else Does :-p ● FREE Consultation. ● +62-8123-594969 (SMS ONLY) Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 22
  • 23. References http://www.oissg.org/ http://www.schneier.com/ http://www.sans.org/ Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 23
  • 24. History Ver 1.0 : Nov 13, 2012. Heker Biasa, http://cahyod.dosen.narotama.ac.id/ 24