Penetration Testing Process

Introduction

• A penetration testing process is defined by successive steps and events performed by the penetration tester to find a path to the predefined objective.

• It is also essential to note that processes do not represent a fixed recipe and are not a step-by-step guide.

Penetration Testing Stages

• The most effective way to represent and define these is through interdependent stages.

• These processes are presented in the form of a circular process.

• If we look at this more closely and imagine that even a single component of the circular process does not apply, the entire process is disrupted. Strictly defined, the whole process fails.

Pre-Engagement

• Pre-engagement is educating the client and adjusting the contract.

• All necessary tests and their components are strictly defined and contractually recorded.

• Usually in this stage the following is agreed upon:

  • Non-Disclosure Agreement

  • Goals

  • Scope

  • Time Estimation

  • Rules of Engagement

Information Gathering

• Information gathering describes how we obtain information about the necessary components in various ways.

• We search for information about the target company and the software and hardware in use to find potential security gaps that we may be able to leverage for a foothold.

Vulnerability Assessment

• Vulnerability Assessment stage, we analyze the results from our Information Gathering stage, looking for known vulnerabilities in the systems, applications, and various versions of each to discover possible attack vectors.

• Vulnerability assessment is the evaluation of potential vulnerabilities, both manually and through automated means.

Exploitation

• In the Exploitation stage, we use the results to test our attacks against the potential vectors and execute them against the target systems to gain initial access to those systems.

Post-Exploitation

• At this stage of the penetration test, we already have access to the exploited machine and ensure that we still have access to it even if modifications and changes are made.

• During this phase, we may try to escalate our privileges to obtain the highest possible rights and hunt for sensitive data such as credentials or other data that the client is concerned with protecting (pillaging).

• Sometimes we perform post-exploitation to demonstrate to a client the impact of our access. Other times we perform post-exploitation as an input to the lateral movement process described next.

Lateral Movement

• Lateral movement describes movement within the internal network of our target company to access additional hosts at the same or a higher privilege level.

• It is often an iterative process combined with post-exploitation activities until we reach our goal.

Proof-of-Concept

• In this stage, we document, step-by-step, the steps we took to achieve network compromise or some level of access.

• Our goal is to paint a picture of how we were able to chain together multiple weaknesses to reach our goal so they can see a clear picture of how each vulnerability fits in and help prioritize their remediation efforts.

• If feasible, we could create one or more scripts to automate the steps we took to assist our client in reproducing our findings.

Post-Engagement

• During post-engagement, detailed documentation is prepared for both administrators and client company management to understand the severity of the vulnerabilities found.

• At this stage, we also clean up all traces of our actions on all hosts and servers.

• During this stage, we create the deliverables for our client, hold a report walkthrough meeting, and sometimes deliver an executive presentation to target company executives or their board of directors.

• Lastly, we will archive our testing data per our contractual obligations and company policy.

• We will typically retain this data for a set period or until we perform a post-remediation assessment (retest) to test the client's fixes.

Summary

Stage	Description
Pre-Engagement	The first step is to create all the necessary documents in the pre-engagement phase, discuss the assessment objectives, and clarify any questions.
Information Gathering	Once the pre-engagement activities are complete, we investigate the company's existing website we have been assigned to assess. We identify the technologies in use and learn how the web application functions.
Vulnerability Assessment	With this information, we can look for known vulnerabilities and investigate questionable features that may allow for unintended actions.
Exploitation	Once we have found potential vulnerabilities, we prepare our exploit code, tools, and environment and test the webserver for these potential vulnerabilities.
Post-Exploitation	Once we have successfully exploited the target, we jump into information gathering and examine the webserver from the inside. If we find sensitive information during this stage, we try to escalate our privileges (depending on the system and configurations).
Lateral Movement	If other servers and hosts in the internal network are in scope, we then try to move through the network and access other hosts and servers using the information we have gathered.
Proof-of-Concept	We create a proof-of-concept that proves that these vulnerabilities exist and potentially even automate the individual steps that trigger these vulnerabilities.
Post-Engagement	Finally, the documentation is completed and presented to our client as a formal report deliverable. Afterward, we may hold a report walkthrough meeting to clarify anything about our testing or results and provide any needed support to personnel tasked with remediating our findings.