Penetration Testing Methodologies Quiz

Module Overview

• Module name: COMP40741: Ethical Hacking and Penetration Testing
• Lecture 1: Module Overview and Introduction to Penetration Testing
• Date: 06/02/2025

Module Outline

• Module overview
• Teaching staff
• Module specification
• Learning outcomes
• Assessment(s)
• Introduction to Ethical Hacking and Penetration Testing

Teaching Staff

• Module Leader: Dr. Nemitari Ajienka
• Title: Senior Lecturer, Certified Security Testing Associate (7Safe, GCHQ Accredited)
• Email: [email protected]
• Office: Mary Ann Evans Building (MAE) 329 (moving to MAE 307)
• Phone: +44 (0) 115 848 8306
• Module Team: Dr. Kwame Assa-Agyei
• Title: Lecturer
• Email: [email protected]

Module Specification

• Available in Learning Room on NOW
• Contains information on module overview and aims, module content, delivery methods and schedule, indicative reading, learning outcomes, and assessment

Module Aims

• Equip students with knowledge, skills and ethical considerations to identify and address vulnerabilities in computer systems
• Develop a comprehensive understanding of essential cybersecurity methods of ethical hacking and penetration testing
• Introduce students to principles, methodologies, and tools of ethical hacking and penetration testing
• Develop practical skills in identifying and exploiting vulnerabilities in computer systems
• Assess ethical and legal considerations surrounding penetration testing
• Understand the importance of risk assessment and mitigation in cybersecurity

Learning Outcomes

• Knowledge and understanding:
  • Demonstrate an understanding of penetration testing methodologies
  • Demonstrate an understanding of ethical hacking principles and methodologies
  • Evaluate the legal and ethical implications of penetration testing
  • Identify, analyse and assess vulnerabilities and threats in computer systems
• Skills, qualities and attributes:
  • Apply penetration testing techniques to identify and exploit vulnerabilities
  • Develop effective strategies for securing computer systems and networks
  • Communicate security findings and recommendations through comprehensive reports
  • Demonstrate critical thinking in risk assessment and mitigation

Assessment

• Online in-class test (Individual, 30%, K1-K3)
• Time-constrained online in-class test to demonstrate understanding of theoretical aspects of penetration testing, ethical hacking and legal and ethical considerations
• Report (Individual, 70%, K1, K4, S1-S4) : Written report based on a hands-on penetration testing project demonstrating ability to identify and exploit vulnerabilities, identify and mitigate risks, provide actionable recommendations, and communicate findings

Provisional Module Content

• Week 1-3: Introduction to Ethical Hacking and Pentesting, Overview of penetration testing methodologies, Information Gathering and Footprinting
• Week 4-5: Vulnerability Assessment, Identifying and assessing software and hardware vulnerabilities, Exploiting vulnerabilities.
• Week 6-8: Exploitation Techniques and tools, Developing and executing exploits, Post-exploitation strategies and privilege escalation
• Week 9: Legal and Ethical considerations in penetration testing, Reporting and documentation standards, Risk Assessment and Mitigation
• Week 10: Social engineering techniques/tactics and Support Sessions

Resources or Reference Texts

• Graham, D. G. (2021). Ethical hacking: a hands-on introduction to break in
• Oriyano, S-P. (2017). Penetration testing essentials.
• Khawaja, G. (2021). Kali Linux penetration testing bible
• Sabih, Z. (2018). Learn ethical hacking from scratch: your stepping stone to penetration testing
• Baloch, R. (2015). Ethical Hacking and Penetration Testing Guide
• Relevant research publications from international conferences and journals

Web-based Resources and Tools

• http://www.cyberedge.uk – Requires Registration
• https://cybermillion.immersivelabs.online/register – Requires Registration
• https://www.digitalcyberacademy.com - Requires Registration
• VMWare / Virtual box - https://www.virtualbox.org
• Kali Linux - https://www.kali.org
• Metasploitable - https://www.vulnhub.com/entry/metasploitable-2,29/
• Seedubuntu - https://seedsecuritylabs.org/Labs_20.04/
• Ubuntu - https://ubuntu.com/tutorials/how-to-run-ubuntu-desktop-on-a-virtual-machine-using-virtualbox#1-overview

Best Security Strategy

• Defensive: Controls, Auditing, Policies, Standards, Guidelines, Designing and implementing secure network architecture
• Offensive: Pen testing, Ethical Hacking, Security Assessment, Risk Assessments, Stress Testing

Unfair Security Challenge

• Internet allows attackers to attack from anywhere in the world, just need to find one vulnerability
• Security analysts need to close every vulnerability

Who is the Enemy? A Hacker?

• 1960s and 1970s: Hacker was a positive term for an expert in programming/operating systems
• 1970s onward: Hacker is a negative term for someone using computers without authorization or to commit crimes.

Other names for the enemy

• Crackers: hackers who commit unlawful acts/mischief
• Script Kiddies: use pre-written scripts to commit mischief without understanding
• Blackhat Hackers: unethical intentions

What is their motivation?

• Profit (ransomware, scareware, data theft)
• Fun/Challenge
• Espionage, fraud for competitive advantage
• Vandalism
• Political/Ideological (Hacktivists)
• Power assurance (restore confidence)
• Anger
• Sadistic (derive gratification from pain)

Goodies or Baddies?

• Black Hats: break into systems, share vulnerabilities
• Grey Hats: work as security professionals during the day, "hack" by night.
• White Hats: part of the security community, find flaws and share with vendors

Ethics Discussion

• Educational course for ethical purposes only.
• Lab exercises only on provided testbed systems.

Permission and Privacy

• Ethical hackers must get permission and understand what's allowed
• Permission doesn't mean a free license
• Sensitive information (encryption keys, passwords) must be kept confidential

Responsible Disclosure

• Process of notifying a company about a security vulnerability
• Allows a period for patching before publicly disclosing details
• Minimizes risk of exploitation

Legislations

• Computer Misuse Act 1990 (UK)
• Computer Fraud And Abuse Act 1986 (USA)
• Criminal Code Act Division 477-478 (AUS)

What is Ethical Hacking/Penetration Testing?

• Legal and authorized attempt to locate and successfully exploit vulnerabilities in computer systems to make them more secure
• Probing for vulnerabilities
• "Proof of concept" attacks
• Specific recommendations for addressing and fixing issues
• Finds weaknesses by using tools/techniques used by attackers

Importance of Studying Ethical Hacking/ Penetration Testing?

• EC-Council Cyber Career Paths
• Vulnerability Assessment and Penetration Testing (VAPT) Career Path

Penetration Testing Framework

• Pre-engagement interactions (scope, documentation, engagement rules, third-party environments, past threats)
• Information Gathering (Active/Passive Reconnaissance, OSINT)
• Vulnerability Analysis
• Exploitation (Weakness Exploitation)
• Post-exploitation (Gaining access, privilege escalation, exploits)
• Reporting

Types of Penetration Testing

• Network/Infrastructure
• Database
• Web
• Wireless
• Social Engineering
• Physical

Types of Penetration Tests

• Black-box: client provides no information
• White-box: client provides full details
• Grey-box: client provides partial details

Pre-engagement

• Conversation with client to understand needs
• Different penetration test levels (simple IP addresses, single application, full attack simulation)
• Written and signed permission document required

Topics for Pre-engagement

• Scope
• Documentation
• Rules of Engagement
• Third-Party-Hosted/Cloud Environments
• Success Criteria
• Review of Prior Threats and Vulnerabilities
• Avoiding scan interference

Defining Scope

• Crucial component often overlooked
• Prevents scope creep, customer dissatisfaction, and legal issues
• Defines what is to be tested

Questions – Network Penetration Test

• Purpose of the test? Compliance?
• When should the test happen?
• How many IP addresses are involved?
• Impacting devices (firewall, IDS/IPS, WAF, load balancer)?
• Post-penetration procedures (privilege escalation, tools)

Questions – Web Penetration Test

• Number of web applications/login/static/dynamic pages?
• Source code availability?
• Documentation needed?
• Role-based testing required?
• Credentialed scans needed?

Questions – Wireless Penetration Test

• Number of wireless networks?
• Guest network/authentication?
• Encryption type?
• Coverage area?
• Rogue device enumeration?
• Client attacks?
• Approximate number of clients?

Questions – Physical Penetration Test

• Locations assessed?
• Shared facilities? Scope of floor/area?
• Security guards (bypass, 3rd party, armed, use of force)?
• Entrances? Access to vulnerabilities (locks, keys)?
• Purpose (compliance, audit)?
• Square footage?
• Physical security measures?
• Cameras being used/client-owned?
• Camera data access?
• Alarm systems (present)?

Questions – Social Engineering Testing

• Email addresses for social engineering attacks?
• Phone numbers for social engineering attacks?
• Physical access approval?
• Number of people targeted?

Scope Creep

• Effectively puts penetration testing firms out of business
• Specify start and end dates, IP ranges, domains, validate ranges
• Dealing with third parties
• Permission not always a guarantee on third-party providers
• Testing cloud services can cause problems due to data from multiple organizations stored on a single medium. Lax security between data domains.

ISP

• Verify ISP terms of service, specific provisions for testing.
• Notify Managed Security Service Providers (MSSPs) of testing, specifically systems/services.
• Determining MSSP response time not helpful to testing metrics.
• Important to know the countries hosting servers

This Week's Lab

• Introductory material (Command Line, etc.)
• Creating ImmersiveLabs account
• Exploring penetration testing framework (locally or VMs).
• Complete Command line tutorials/examples
• Complete Google Dorks lab
• Download VM files/setup virtual environment

Reading List

• Penetration Testing Cheat Sheet (https://github.com/ivan-sincek/penetration-testing-cheat-sheet)

Next Week

• Information Gathering and Footprinting: Reconnaissance techniques, Passive and Active information gathering, Open-source intelligence (OSINT) gathering

Questions?