SANS 560 Notes

560.1 Sans 560: Network Penetration and Ethical Hacking

Definitions

• Threat: Agent That can Cause harm
• Vulnerability: A flaw that can be exploited
• Risk: Overlap of Vulnerability and threat
• Exploit: Code/Technique used by a threat on a vulnerability
• Active attack: manipulates target
• Passive Attack: Does not manipulate target
• Ethical Hacking: Using attack techniques to find flaws with permission, to improve security ( aka white hat hacker )
• Penetration testing: An attempt to gain entry to a network
• Security Assessments/Vulnerability Assessment: Finding vulnerabilities
• Security Audit: Comparing findings against a set of standards
• Phases of an attack
  • Recon
  • Scanning
  • Exploitation
• Pentesting limitations:
  • Scope
  • Time
  • Methods
• Pentester limitations:
  • scope
  • time
  • methods

Public/Free methodologies

• Open Source Security Testing Methodology Manual [1]
  • Focus on Transparency, business value
  • Broad descriptions of categories
  • Numerous templates

• NIST [2]
  • Processes
  • Roles
  • Tools
  • High-level

• OWASP [3]
  • Web app testing
  • compares impact: likelihood

• Penetration Testing Framework [4]
  • Network penetration tests
  • Specific tools, commands
  • Step-by-step
  • Recon
  • Social Engineering
  • Scanning/probing
  • enumeration

Overall Methodology

• Preparation
  • Sign a NDA
  • Discuss nature of the test
    • Identify threats/Concerns
    • Agree on rules of engagement
    • Determine scope of test
  • Sign off on permission, notice of danger
    • Vital to get before starting
    • "Get out of jail free" card
  • Assign team
• Testing
  • Conduct the test
• Conclusion
  • Perform detailed analysis
  • Retest
  • Reporting
  • Presentation

Limitation of liability/insurance

• Should be drawn up by a lawyer
• Generally limited to a value of project

Rules of Engagement

• Emergency contact info ( 24/7 )
• Daily debriefings
• Dates and times of day
• Announced/unannounced
• Shunning ( IDS/IPS )
• Black-box vs Crystal-box testing
• Viewing data on compromised systems
• Observing tests
• Document agreements and both sign off

Scope

• What are biggest concerns?
  • Disclosure of sensitive info
  • Interruption in production processing
  • Embarrassment ( defacement )
  • Compromising for deeper penetration
• Avoid scope creep
• What to test
  • Domain names
  • Address ranges
  • hosts
  • applications
• Third party System
  • ISP's
  • DNS
  • Hosting
  • Get permission
• Test vs. production
• How to test
  • ping port scan
  • vulnerability scan
  • penetration
  • client-side
  • application
  • physical pen
  • social engineering
• Internal vs external
  • On-site, granted access
  • On-site, sneak in
  • VPN access
• Testing client-side
  • Browsers
  • Phishing
  • E-mail exploits
• Social Engineering
  • Controversial
  • Ensure explicit permission
  • Define explicit goal
  • Establish pretexts, scripts in advance
  • Use a friendly people person ( female is better)
• Denial of Service
  • Check version numbers or try to crush? Be explicit!
• "Dangerous" exploits
  • should they be included?
  • Any test can potentially crash a host

Reporting

Always Create a report

• Even for inhouse tests