Penetration Testing Training: Tools and Techniques

Acquiring target information

• Locating useful and relevant information
• Scavenging published data
• Mining archive sites

Scanning and enumerating resources

• Identifying authentication methods
• Harvesting e–mail information
• Interrogating network services
• Scanning from the inside out with HTML and egress busting

Correlating weaknesses and exploits

• Researching databases
• Determining target configuration
• Evaluating vulnerability assessment tools

Leveraging opportunities for attack

• Discovering exploit resources
• Attacking with Metasploit

Bypassing router Access Control Lists (ACLs)

• Discovering filtered ports
• Manipulating ports to gain access
• Connecting to blocked services

Compromising operating systems

• Examining Windows protection modes
• Analysing Linux/UNIX processes

Subverting web applications

• Injecting SQL and HTML code
• Hijacking web sessions by prediction and Cross–Site Scripting (XSS)
• Bypassing authentication mechanisms

Baiting and snaring inside users

• Executing client–side attacks
• Gaining control of browsers

Manipulating internal clients

• Harvesting client information
• Enumerating internal data

Deploying the social engineering toolkit

• Cloning a legitimate site
• Diverting clients by poisoning DNS

Initiating remote shells

• Selecting reverse or bind shells
• Leveraging the Metasploit Meterpreter

Pivoting and island–hopping

• Deploying portable media attacks
• Routing through compromised clients

Pilfering target information

• Stealing password hashes
• Extracting infrastructure routing, DNS and NetBIOS data

Uploading and executing payloads

• Controlling memory processes
• Utilising the remote file system

Masquerading network traffic

• Obfuscating vectors and payloads
• Side–stepping perimeter defences

Evading antivirus systems

• Discovering stealth techniques to inject malware
• Uncovering the gaps in antivirus protection

• Reporting results and creating an action plan
• Managing patches and configuration
• Recommending cyber security countermeasures