This document provides an overview of penetration testing, including: - Defining penetration testing as discovering and documenting security flaws in a system. - The steps involved: footprinting, scanning, enumeration, gaining access, escalating privileges, covering tracks, and creating backdoors. - Common tools used like Nessus, an integrated security scanning tool. - The goal is to simulate an attack to evaluate security by finding vulnerabilities from misconfigurations, flaws, or process weaknesses.

1. PenetrationTesting Vimukt Tiwari (vtiwari@ptc.com)

3. What can be achieved using it ?

4. How can it be performed ?

5. Which tools are used to perform Pen Test ?

7. It can never prove the absence of security flaws. It can only prove their presence.

8. Profiles of pen testing :-

9. External pen tester with no knowledge of the system.

10. External pen tester with access to the system.

12. Pen test is conducted to evaluate the security of a computer system or network by simulating an attack from a malicious source, known as a Black HatHacker, or Cracker.

13. The process involves an active analysis of the system for any potential loop holes that could result from :-

14. Poor or improper system configuration.

15. Both known and unknown hardware or software flaws.

18. Here are some of the pieces of information to be gathered about a target during footprinting:

19. Domain name

20. Network blocks

21. System architecture

22. Specific IP addresses

23. Phone numbers

25. There are mainly 3 types of scanning :

26. Network Scanning

27. Port Scanning

29. Here are the list of some important services enumeration:

30. Enumerating SMTP, TCP 25

31. Enumerating HTTP, TCP 80

32. NetBIOS Session Enumeration, TCP 139

33. Enumerating TFTP, TCP/UDP 69

34. LDAP Enumeration, TCP/UDP 389 and 3268

37. Flood a network with traffic, thereby preventing legitimate network traffic.

38. Disrupt connections between two machines, thereby preventing access to a service.

40. Main scanning engine running on Unix server with client GUI running on Unix or Windows.