Penetration Testing (Pentesting)

One thing that's become very prevalent nowadays is something called penetration testing, or pen testing for short. What it is is when we try to penetrate a network, or we're testing the penetration of a network, and in doing so we're going to define vulnerabilities. Essentially what we're doing is we're thinking like a hacker: what would a hacker do to penetrate our network?

Pen testing is when we think like a hacker and we're trying to hack into a network, and in doing so we're going to find all sorts of vulnerabilities that we might not see if we are just administering a network and thinking like a technician.

The Pen Testing Process

Most of the time you're going to be using some sort of outside source for your pen testing. So the first thing that's going to happen is you're going to set up some pre-engagement activities. What that is is, what's the contract going to look like, what's the payment terms, what is the scope of the work — you're going to work out all of those details.

Then what's going to happen is, once you agree upon that and sign everything that you need to sign, they're going to go through the process of trying to exploit your network, find those vulnerabilities, hack into your networks. They're essentially thinking like a hacker, and they're going to go through the steps of reconnaissance, where they're discovering information about your company and about your network and about your infrastructure and any details they can find. They're going to identify a vulnerability within that network and start exploiting it, and then they have quite a few steps that they'll go through post exploitation in leveraging all of this. They'll create a report and then hand over the report to you.

During that exploitation there's a lot of things that they'll follow and they'll carry out. They'll probably do some sort of privilege escalation, because that's what a hacker would do — however they get into the network, they would escalate their privileges so they can really cause some damage or be able to get access to things. They'll probably carry out some sort of persistence attack, where if they were to be removed from the network they would still have access. So generally speaking they'll create some sort of other accounts that they can gain access back into the network with, or leave traces behind, or install some software so that they can gain access to the network again. And then they'll also start covering their tracks and make sure that they're not leaving any traces.

The Tools

There's a variety of tools that they'll use, a lot of tools that hackers will use. Things like scanners, like a SCAP scanner. Maybe they're looking at a network traffic analyzer, or like a packet sniffer. They could be doing vulnerability scans on your network — very likely they'll be doing some sort of vulnerability scan on your network to find those vulnerabilities. Maybe they have protocol analyzers that they can take a look at different protocols that are going on there. Or port scanners, scanning ports to see what ports are open so they can leverage that. HTTP interceptors, where they can grab HTTP traffic and either alter it or just do some eavesdropping with it. Maybe password crackers, where they're trying to crack passwords on your network. And there are lots of different exploit frameworks as well, and frameworks would be like a suite of these tools all wrapped up into this framework that they can use to do these exploitations.

How It Compares to Vulnerability Scanning

Ultimately, especially in certain phases of this, pen testing looks a lot like vulnerability scanning, in that they are going to be scanning your network for vulnerabilities, they're going to be trying to poke holes into things, and then they're taking the next step and escalating it. But because it looks a lot like vulnerability scanning, there's a lot of similarities between these two.

When we're setting up this engagement and how this pen testing is going to operate — if we were looking at scan settings, one thing that we would consider is what is the scope: are we scanning from outside the network or inside the network? Well, it's the same thing when hiring a pen tester. Do we want to have them test as if they are coming from the outside, or test as if it was an insider threat?

Same thing, are they going to do active or passive scans with this? This comes from a reconnaissance standpoint, and we're going to talk a little bit more about that.

Are we going to give the pen tester credentials to get into our system? Let's say we're a SaaS company and we have users that are like clients and customers that are logging into our system. Are we going to give them credentials as if they were a customer logged into the system, or are they going to not have credentials and see if they can attack the system? A lot of times what I'd say is we'll have them do both — first of all a non-credentialed attack.

With scanner settings, you do have agents that you install on the computer. It's not quite the same with a pen tester, although a pen tester, as part of their tech, maybe they do install something to gather more information. And then there's not necessarily a sensitivity level, except for you are going to specify the scope and the depth of how far the pen tester is going to go to try to penetrate your network. Really, there's all the same considerations for both.

The pen tester could affect performance, and that could be a concern. So maybe there's some sort of scheduling, like they do it off hours when your users are not online. Or perhaps they need to do some sort of throttling, or limit how much bandwidth they have. Or maybe there's just some operational considerations. An example with segmentation: what I would actually do is I'd have pen testers go after our staging environment, because I wouldn't want to expose our user information and some sensitive information to our pen testers if we don't have to. So they would attack our staging environment instead, so if anything were to ever be compromised it was just in our staging environment and not in our actual production environment.

Reconnaissance, Knowledge and Physical Access

From a reconnaissance standpoint, you can have them choose to do an active, where they actually go in there and they're hitting everything, or a passive, where they're just seeing the traffic on the network initially before they take any actions. Or you could ask them to do both: start out with passive and then move to active, so that way you're really fully testing out what your network is.

When it comes to a pen tester, are they going to know about the environment ahead of time, or do they have a blank slate as if an attacker is starting fresh with the environment? Obviously there's a lot of advantages to knowing the environment first, but perhaps you don't want to give them that detail and just figure out if they can hack your network first without those details. Or maybe you give them some information so they partially know about some of the information within the network.

Are you going to have this pen tester physically access the network? A lot of times when I hired a pen tester they would all happen from a virtual standpoint. But does it change the effect if they can physically gain access — maybe do some dumpster diving and figure out what's inside the dumpster, or be able to physically break into the building? So there's some physical aspects to whether you want the pen tester to take that step.

Similarly, they could do some social engineering. Are you going to have them call your employees and see how well your employees respond? So doing some social engineering as part of the pen testing could be a critical part.