參考答案
The phases and the order in which they are done can differ depending on who you talk to. In general, these are the phases of a penetration test, many of which will be repeated as the test progresses:
-
Pre-engagement
-
Information gathering
-
Vulnerability assessment (as a phase built-in to the pentest)
-
Exploitation
-
Post-exploitation
-
Lateral movement
-
Post-engagement
During the pre-engagement phase, all of the important work (not as exciting) is done to ensure all relevant parties understand and document the details and expectations of the test.
At the information-gathering phase, the test and fun begins. This is where I start doing open source intelligence (OSINT) and enumerating hosts, the network, and any reachable services.
I will be documenting any promising findings that the client should know about, like:
-
Unexpected services and IP subnets that are reachable.
-
Secrets found in public-facing GitHub repos, AWS S3 buckets, and other cloud storage technologies.
-
Social media activity from employees that may reveal what technologies are used at the company (commonly found on job descriptions).
-
A visual network diagram to assist me in enumeration and discovery throughout the engagement.
At the vulnerability assessment stage, I start using the information we gathered to determine if there are any vulnerabilities present that can be exploited.
I might start looking up known vulnerabilities based on service and software versions, noting any CVEs, finding proof of concept exploits (PoCs), and carefully planning the attack attempts.
At the exploitation phase, I'll perform the attack and/or series of planned attacks to attempt to exploit any vulnerabilities.
If I have been brought on to test an environment externally and internally, I will be attempting to exploit a vulnerable public-facing system to see if the vulnerability will allow me to pivot from that external-facing system onto internal IT infrastructure.
There are some companies that still host their own websites on-prem in a DMZ, but it is more common for companies to use 3rd party website hosting services or cloud providers for website or web application hosting.
If the engagement calls for me to test from the internal perspective, my contact will provide me with remote access via virtual private network (VPN) or even use an attack VM that gets spun up somewhere on their internal network environment.
Regardless, I will document each attack I attempt (successful and unsuccessful), including the date and time for full transparency.
In the post-exploitation phase, I will check to see what kind of privileges the account I landed on has. If it is a Windows system I'll run a series of commands to live off the land, discover interesting files, and find potential pathways for privilege escalation, including but not limited to:
-
whoami /priv
-
ipconfig /all
-
netstat -antp
-
arp -a
-
Systeminfo
-
wmic qfe get Caption, Description, HotFixID, InstalledOn
I'll also look for any interesting files on the system using a series of search-centric commands and scripts (example: WinPEAS) that are configured to look in common directories using keywords that may find files containing sensitive information.
Depending on how secure the environment is, I may choose not to run any type of pre-made scripts to attempt to avoid any potential detections. That said, I understand that it isn't always bad to get detected as a tester.
It helps the organization see what they are doing right as well, I just wouldn't want the engagement to end too soon ?.
At the lateral movement phase, I will use information gathered from what I did in post-exploitation to determine if I can—and how I should—try to move laterally to another system on the network.
Lateral movement and post-exploitation are very closely related, as are all the phases. This may mean that I discover the Windows system I land on is part of a Windows domain, and I try to harvest domain user credentials that I could use to remotely access another system on the network through WinRM.
During the post-engagement phase, the report will be prepped to be delivered to the client. I would, of course, use whatever template our company uses to remain in line with our quality standards, operational practices, and style.
As a team, we may come together to discuss the scoring of each vulnerability to communicate impact and prioritize mitigation based on severity.
We would also work with the client to schedule a time when we can discuss our findings with all the relevant stakeholders.
加入Telegram學習組 ▷