Scribd
Upload
52 views

Penetration Testing: Sachin Phapale (Ciseh & Cissp)

The document discusses penetration testing methodology. It outlines a 5 step process: reconnaissance, scanning and enumeration, gaining access, maintaining access, and covering tracks. It describes the tasks involved in each step such as passive information gathering, vulnerability mapping, exploiting vulnerabilities to gain access, privilege escalation, and removing tools to cover tracks. The document also mentions frameworks, customizing tools, engagement preparation, and writing quality reports for clients. The overall message is that penetration testing requires thorough research, organization, and attention to detail while avoiding illegal activities.

Uploaded by

fsdfds
Copyright
© © All Rights Reserved
Available Formats
Download as PPSX, PDF, TXT or read online on Scribd
52 views

Penetration Testing: Sachin Phapale (Ciseh & Cissp)

The document discusses penetration testing methodology. It outlines a 5 step process: reconnaissance, scanning and enumeration, gaining access, maintaining access, and covering tracks. It describes the tasks involved in each step such as passive information gathering, vulnerability mapping, exploiting vulnerabilities to gain access, privilege escalation, and removing tools to cover tracks. The document also mentions frameworks, customizing tools, engagement preparation, and writing quality reports for clients. The overall message is that penetration testing requires thorough research, organization, and attention to detail while avoiding illegal activities.

Uploaded by

fsdfds
Copyright
© © All Rights Reserved
Available Formats
Download as PPSX, PDF, TXT or read online on Scribd
You are on page 1/ 13

Penetration Testing

Sachin Phapale
(CISEH & CISSP)
Agenda
● Introduction about me
● Penetration testing Methodology
● Pen testing Frameworks
● Customizing your tool set
● Engagement Prep
● Post Engagement
● Wrapping it all up
The about me stuff
Hello Friends,
• I am an Individual Certified Information
Security Researcher and Ethical
Hacker!(CISEH)
• Now a days working to share knowledge on
Web Security and spreading awareness
about common securities.
Ethical Pentesting Methodology?
● No such thing if you want to be successful
● You need to think like a hacker
● Pentesting methodologies cover all grounds
and help win assessments
● Attention to details and organization skills
● Push the envelope but do not cross the line
Penetration Methodology
5 step process
● Reconnaissance/Footprinting
● Scanning & Enumeration
● Gaining Access
● Maintaining Access
● Covering Tracks
Penetration Methodology Cont.
● Reconnaissance
– Gathering information passively
– Not actively scanning or exploiting anything
– Harvesting information
● Bing, google, yahoo, yandex

● Way back machine (archive)

● shodan

● Social media etc


Penetration Methodology Cont.
● Scanning & Enumeration
– Target discovery
– Enumerating
– Vulnerability mapping
Penetration Methodology Cont.
● Gaining Access
– Mapped vulns
– Important to penetrate gaining user and
escalating privs
– Try multiple vectors. This is actually a
decently easy part
– Web application, wifi, social engineer.
– Use your research
Penetration Methodology Cont.
● Maintaining Access
– Keeping account access
– Privilege escalation
– Pivoting to own all
– ET phone home
Penetration Methodology Cont.
● Covering Tracks
– Removing tools
– Backdoors, ET phone homes
– Clearing logs
– Windows security, application and system
logs
– Linux /var/log/*
– Remove audit logs carefully!!!!!
Refferences
● https://vulnerabilityassesment.co.uk
● https://pentest-standard.org
● Open Source Security Testing Methodology Manual (OSSTMM)
● Information Systems Security Assessment Framework (ISSAF)
● Open Web Application Security Project (OWASP) Top Ten
● Web Application Security Consortium Threat Classification (WASC-TC)
● https://ieeexplore.ieee.org
● https://www.ijecs.in
● www.ijirset.com
● www.academia.edu
● https://www.researchgate.net
● Book referred “The Tribe of Hacker”
Report Writing
● It is the last thing the customer sees. Make it the
best thing they see
● Customers are paying for quality
● Different reports for various teams
● Executive Summary
● Detailed Summary
Wrapping it all up
● Pentesting has numerous components
● Its not always about hacking its about research
and business
● Making sure you are NICHE at what you do.
Know your target and field
● Always improve your methods while helping
your client improve their infrastructure
● “Don't learn to hack, Hack to learn”

You might also like