Ethical Hacking and Penetration Testing

• Protego Security Solutions welcomes new employees and aims to enhance their cybersecurity skills.
• The course covers penetration testing and building a practice lab environment.
• Understanding core concepts of hacking, the difference between ethical and unethical hacking, current threats, and attacker motivations is crucial before performing penetration testing.
• Effectiveness in penetration testing requires methodological approach and understanding of different testing types and industry methods.
• Hands-on experience is gained by building a lab environment for testing.

Key Module Components

• Introduction to Ethical Hacking and Penetration Testing is the module's title.
• The module aims to explain the significance of ethical hacking and penetration testing using methodologies.
• The topics cover understanding ethical hacking, exploring penetration testing methodologies, and building a personal lab.
• The learning objective is to understand ethical hacking and penetration testing importance.
• Exploring penetration testing methodologies aims to explain types of penetration testing methodologies and frameworks.
• Building your own lab focuses on configuring a virtual machine for penetration testing learning.

Protego's Approach to Penetration Testing

• Alex from Protego will mentor employees to prepare them for customer engagements, enhancing their skills.
• A strong understanding of the company's purpose is required to understand objectives.
• An ethical hacker acts as an attacker to minimize computer network risks.
• The NIST Computer Security Resource Center (CSRC) defines a hacker as someone with unauthorized access to an information system.
• Ethical vs nonethical hacking depends on the intent.
• Permission to attack, known as "the scope," avoids legal issues.
• Security researchers disclosing vulnerabilities to vendors are ethical hackers.
• Exploiting vulnerabilities for unauthorized access would be considered nonethical hacking
• Publicly disclosing vulnerabilities without vendor coordination is also nonethical.
• Ethical hackers use the same tools as nonethical hackers but report findings and avoid destructive tests.
• The goal of ethical hacking is to analyze network security and identify weaknesses.
• Penetration testing assesses security posture to determine potential compromises.
• Hacking is NOT a Crime is a nonprofit that aims to combat the negative perception of hackers, portraying them as curious individuals who want to secure systems.
• Defensive techniques such as antivirus software, firewalls, and IPS are implemented for network security.
• Penetration testing validates the effectiveness of security defenses.
• Penetration testing helps answer if defenses work, data is protected adequately and the proper assets are secured.
• Penetration tests determine what needs protecting and defense effectiveness against threats.
• Networks and systems change, which requires reevaluating security.
• The NICCS Cyber Career Pathways Tool provides descriptions of different cybersecurity job roles.
• Ethical hacking jobs are compared to understand their role in the profession.

Network Infrastructure Tests

• Assessing the actual network infrastructure is the focus of network infrastructure tests, which includes switches, routers, firewalls, AAA servers, and IPSs.
• Wireless infrastructure testing may be part of a network infrastructure test or a separate assessment.
• Wireless security testers attempt to breach networks via wireless.
• Testing wireless infrastructure finds network weaknesses including exposure and signal strength.

Application Based Tests

• Application security flaws, including flaws including miseconfigurations, input validation errors, injection issues, and logic flaws are the focus of pen testing for enterprise apps.
• Web application testing sometimes includes back-end databases to focus on access via web app compromises
• The Open Web Application Security Project (OWASP) is a great resource for secure coding.

Penetration Testing in the Cloud

• Cloud service providers (CSPs) ensure security and compliance.
• Amazon's Shared Responsibility Model outlines customer and Amazon responsibilities.
• Cloud security responsibilities rely on which cloud model is used: SaaS, PaaS, or laaS.
• In laaS, the cloud consumer manages data, apps, VMs, and operating systems.
• Both clients and providers must ensure security, prior to signing contracts.
• Agreements should address disaster recovery, SLAs, data integrity, and encryption
• Encryption end-to-end or just at the cloud is an important consideration.
• It is important to establish who manages encryption keys which will either be the CSP or the client.

Environmental Considerations

• Pen tests can be combined or done as individual assessments.
• It is important to ensure CSPs offer similar security you would have under local control.
• Understand what is permissible when penetration testing in the cloud.
• CSPs offer security assessments and penetration testing guidelines. Potential threats remain when moving to the cloud: data is still in a physical place
• Cloud providers provide agreed security in writing to customers.
• Amazon's policy for penetration testing is available online.

Penetration Testing Types

• Physical security testing, often enjoyed by testers, assesses facility security.
• These tests expose weaknesses and security through assessment of external physical security controls.
• Social engineering is used in the majority of compromises.
• Testing employee responses to social engineering is important.
• It is important to assess security awareness program and avoid singling out those who fail. Dave Kennedy's Social-Engineer Toolkit (SET) is useful for social engineering testing.
• Bug bounty programs offer recognition and compensation for vulnerability discoveries.
• Microsoft, Apple, Cisco, and the DoD use bug bounty programs.
• Third-party platforms like HackerOne, Bugcrowd, Intigriti, and SynAck connect businesses with security professionals.
• A GitHub repository provides bug bounty tips: https://github.com/The-Art-of-Hacking/h4cker/tree/master/bug-bounties
• Pen testing is categorized by perspective: unknown, known, or partially known environments.
• Testers with only domain names and IP addresses conduct unknow-environment tests.
• The external attacker perspective involves gathering information without target knowledge.
• The target's network personnel might not be informed of the test, creating a defense exercise
• Testers with significant information, like network diagrams and credentials use the known-environment.
• Testing finds as many security holes, while unknown-environment tests identify a route into the company.
• Internal configuration audits and desktop scanning is more common in " known-environment"
• Budget, timelines, and company concerns factor in deciding which test to conduct.
• Companies with specific server or application concerns can offer data to narrow the test scope.
• Networks will become comprised, therefore a white-box approach is recommended. Partially known environments blend unknown and known tests. Testers access client machines to pivot through the network. Compromises often begin at the client, and affect the rest of the network A good plan would be for testers to start inside the network and evaluate impact of a breach

Security Standards and Methodologies

• Penetration testing methods are continually updated to address new threats.
• Offensive security teams use the MITRE ATT&CK framework.
• It is used by both penetration testers and incident responders/threat hunters.
• The MITRE ATT&CK framework organizes adversary tactics, techniques, and procedures (TTPs).
• Enterprise ATT&CK Matrix, Network, Cloud, ICS, and Mobile list adversary tactics.
• Preparation for attacks involves gathering information (OSINT) and people weakness exploitation.
• The OWASP Web Security Testing Guide (WSTG) focuses on web application testing.
• The OWASP WSTG is a comprehensive manual with different phases of web application security testing.
• The WSTG details attack vectors for cross-site scripting (XSS), XML external entity (XXE) attacks, cross-site request forgery (CSRF), SQL injection attacks, and how to prevent them.
• NIST SP 800-115 gives guidelines for information security testing. It is an industry benchmark for penetration testing guidelines.
• The Open Source Security Testing Methodology Manual (OSSTMM) is a guide for repeatable and consistent security.

OSSTMM Key Sections

• Operational Security Metrics
• Trust Analysis
• Work Flow
• Human Security Testing
• Physical Security Testing
• Wireless Security Testing
• Telecommunications Security Testing
• Data Networks Security Testing
• Compliance Regulations
• Reporting with the Security Test Audit Report (STAR)
• The PTES gives info on attack types, methods, and the latest tools.
• Pre-engagement interactions are a component.
• Intelligence gathering is an importnant consideration in evaluating threat actors.
• Threat modeling, where testers mimic malicious actors, uncovers types of threat they would pose.
• Vulnerability analysis is a large consideration when testing cyber infrastructure.
• Exploitation and Post-exploitation
• Information gathering and Network mapping
• Vulnerability identification and Gaining access and privilege escalation
• Enumerating further and Compromising remote users/sites
• Maintaining access and Covering the tracks are key phases of exploitation.

Building a Lab

• Practice is essential for skills development, maximizing contributions to Protego teams.
• Certain sites on the open internet can be practiced on, and simulated target networks with granted access,
• Some ethical hacking tools can be seen as illegal if not given access. The definition of what is legal or illegal varies by location.
• Assess the legality of planned activities prior to ethical hacking.
• A virtual machine (VM) with Kali Linux and ethical hacking tools can be explored.
• A proper lab environment is important to develop skills
• Types of tools vary based on the testing you are doing.
• A lab environment is needed for testing on a customer network if penetration testing on a customer network, your own network or a device is occurring.
• Customer-staging environments are targeted as those are the environments that are of concern
• Your tools must be tried and true because it is a critical environment,
• Always test the lab tools and techniques before running them against a customer network as tools can break applications
• Determine what to expect before unleashing tools on a customer network.
• A closed network for testing is needed if testing a specific device/solution.

Linux Distributions

• Kali Linux, Parrot OS, and BlackArch include tools and resources for pen testing
• Deploy a testing lab by using couples of VM
• Parrot security requires: Host-only network and Virtual Switch
• Vulnerable Windows System requires: Hypervisor (Virtual Box) and bare metal

WebSploit Labs

• WebSploit labs provide 450 exercises.
• There is guidance for building penetration testing labs to practice skills.
• A customized version of Omar Santos' lab environmennt is available.

Requirements and Guidelines for Labs

• Closed network: Controlled access helps to restrict access from the Internet.
• Virtualized: Easy deployment and recovery
• Realistic: Matching of the environment helps when testing
• Health: Helps to indicate if an error have happened
• Sufficient hardware: Ensures lack of resources does not exist
• Multiple operating: Testing or validating from one system or another with different parameters
• Duplicate: Testing or validating to see an error

Penetration Testing Tools

• It's not possible to utilize one section. The tools depend on the type of testing you are doing.
• Evaluating various attack surfaces is part of a customer environment for testing. Surfaces include: network infrastructure, wireless infrastructure, web servers, database servers, Windows systems, or Linux systems.
• Network: Sniffing, traffic manipulation, or devices flooding
• Wireless testing: WPA/WAP cracking, deauthorizing network devices
• Automated tools can locate vulnerabilities to access SQL injections. Fuzzing tools test the robustness of protocols.
• A GitHub repository by Omar Santos includes numerous cybersecurity resources
• Building Your Own Cybersecurity Lab and Cyber Range for guidance is provided.

Lab Best Practicies

• Ensure closed access to the network and internet.
• Create a virtualized computing environment.
• Provide sufficient hardware resources to ensure valid results.
• Being able to recover your lab environment is important because you will break things.
• Use virtual machines.
• Full back up.
• Kali Linux tools and practice is used for pen testing techniques. It contains all the Kali tools plus targets
• You can use the simulated targets and other networks such as you home network.

Planning and Scoping

• Planning and scoping is required so that they are aware of the legal compliance documents.
• Planning and scoping requires: Local Law and legal concepts.

Compliance based assessment

• Compliance-based assessment requires: To verify the audit the security, which should be the following : PCI DSS and HIPAA.
• You are hired to conduct such work with the local, service agreement, and service of work.

Regulations In The Financial Sector

• Financial assets or material used for financial transaction must be maintained for those engaging in banking.
• Section 501(b), which contains: Interagency guideline: Fed financial
• The Federal and NY department service is a: FDIC Safeguards Acts, and NY DFS cyber security.

Key Parts Of Title V, Section 501(b)

• Check Cashing, Payday lenders
• Mortgage, and nonbank lenders
• Companies that use info about people to offer loans
• Educational tools that give people money who need it
• People who get money and financial assets such as real estate
• Business such as retailers.
• Enforced by federal trade such as insurance for lenders. FDIC covers this also

Encompassing Data

• Fed Ramp- It requires to make sure they meet the standard compliance.
• The data of privacy is strengthened with GDPR to enhance the exports of personal data outside

Considerations in Penetration Testing

• You might be traveling to another country with different local laws and restrictions.
• Pen testers were accused and even arrested for allegedly the act.
• You need documentation about local, technical constraints and the tech used. Such as GPDR, CCPOA

Service level Agreements

SLA that is documented for the expectations or constrained related to certain timelines and costs

Confidentiality

You must agree on what can't be shared or handled during testing

Statement of Work

Specifies the timeline. It includes all aspects of the work

Master Service Agreement

They are the main contracts with the company

Non-disclosure agreement

It is a illegal binder that has information

Various Background Checks

• Unilateral: Only has information for both parties
• Bilateral: It also has information by either parties
• Multi Land Trail: Has other parties

Rules Of Engagement

• Needs to specify the rules of an engagement with the client
• Needs to be a rules of engagement that is in a document. Gantt charts or something similar
• Must have all the documents.
• Should have many support such as the network documentation and the api documentation.

Scoping

Important to validate with contracts the target audiences. For reporting is a good way

Time management

Need to consider when to communicate

Ethical Code and Mindset

• Hacking is legal and must come with certain ethics
• Important to have an ethical code

Ethical Guidelines

• Background, agreement, and the usage tools all depend on the engagement being done.

Data Protection

• Must be private and protected and kept confidential.

Financial Info

• The client could potentially have financial information with your client. You should ensure that they follow the specific financial laws