Penetration Testing: Rules of Engagement

Domain 1

• Smaller penetration testing budgets result in increased constraints.
• Rules of Engagement include the timeline, location, and test boundaries.
• The timeline determines how long the penetration test is conducted and when it can start and when it can start.
• Time restrictions determine when testing is not authorized and are in the Rules of Engagement.
• Test boundaries define what will be tested during the penetration test.
• White hat hackers always get permission before penetration testing.
• Permission from both the organization and the cloud provider is needed before penetration testing if services/servers are cloud-based
• A Statement of Work (SOW) documents the work to be performed during a penetration test.
• Black-box testing simulates an outside attack by examining the network and systems without prior knowledge of its internal design or structure.
• Advanced Persistent Threats (APTs) have the best capability and intent to hack a network and remain undetected for extended periods and are organized and well-funded.

Domain 2

• Reconnaissance is a systematic attempt to locate, gather, identify, and record information about a target
• Ping, Google, and Maltego are used during the reconnaissance phase.
• John the Ripper is used for password cracking and is an exploitation tool.
• Scanning actively connects to a target to identify open ports and services.
• Packet inspection manually enumerates a system by analyzing the captured packets.
• Cryptographic inspection determines the encryption being used by a system.
• Network traffic sniffing intercepts and logs network traffic.
• Decompiling is reverse engineering software, while debugging identifies and removes errors

Domain 3

• Phishing lures people to provide sensitive data, often using email.
• SMS Phishing uses SMS/text messages to trick users into providing personal information.
• Impersonation is the act of pretending to be gain access or gather information
• Authority, urgency, and social proof are used to get an employee to comply during an attempt to get assistance or information.
• Tailgating is when a pentester follows an authorized individual to a secure location.
• Dumpster diving is a reconnaissance technique involving searching an organization's trash.
• Simple Mail Transfer Protocol (SMTP) is the internet standard for sending and operates on port 25
• DNS Cache Poisoning allows DNS poisoning on the local computer/server.
• SSL Stripping is a type of downgrade attack that forces a browser into an insecure HTTP connection instead of a secure HTTPS connection.
• Denial of Service (DOS) attacks exhaust resources to prevent authorized users from gaining access.

Domain 4

• Nmap is a command line tool to sends packets to a target and discovers hosts/services based on responses.
• Nmap -sV command detects the version of applications
• Nmap -T sets the timing for the scan
• Reconnaissance collects information before attacking a system.
• Configuration compliance ensures a system meets a security baseline or policy.
• IDA is a commonly used decompiler.
• Nmap isn't commonly used for debugging software. GDB, IDA Pro, and Ollydbg are.
• OpenVAS is a vulnerability scanner.
• Immunity Debugger analyzes malware and reverse engineers binary files
• Aircrack-NG contains a scanner, packet sniffer, and password cracker and is used in wireless hacking

Domain 5

• Normalization combines data from multiple sources into a consistent format.
• Deconfliction determines if activity was performed by a hacker or authorized tester.
• Findings and recommendations should be treated as confidential.
• Final reports should include a prioritized list of recommendations
• Authentication factors are what you know, what you have, what you are, where you are, and what you do
• Footprinting is not part of Post-Report activities
• Client Acceptance is signed at the end to signify that the client agrees you have fulfilled the requirements.
• Data collected needs to be in an encrypted format, be handled with due diligence and care, and must be aggregated, normalized, and correlated
• Indicator of compromise is an artifact that indicates a network has been exploited.
• Communication is important to have before, during, and after a penetration test.