Penetration testing -A systeamtic approch
- 1. What is Penetration testing ? A vulnerability scanner runs from the end point of the person inspecting the attack, to the surface in question. The software compares details about the target attack surface to a database of information about known security holes in services and ports, anomalies in packet construction, and potential paths to exploitable programs or scripts. The scanner software attempts to exploit each vulnerability that
- 2. Importance of penetration test : Security Audit A security audit just checks whether the organization is following a set of standard security policies and procedures Vulnerability Assessment A vulnerability assessment focuses on discovering the vulnerabilities in the information system but provides no indication if the vulnerabilities can be exploited or the amount of damage that may result from the successful exploitation of
- 3. Penetration Testing Penetration testing is a methodological approach to security assessment that encompasses the security audit and vulnerability assessment and demonstrates if the vulnerabilities in system can be successfully exploited by attackers
- 4. Vulnerability Assesment A vulnerability assessment focuses on discovering the vulnerabilities in the information system but provides no indication if the vulnerabilities can be exploited or the amount of damage that may result from the successful exploitation of the vulnerability
- 5. Vulnerability scanning vs. penetration testing Vulnerability scanning and penetration testing are often confused, but in fact the two security procedures are quite different and are used for different purposes. At the most basic level, vulnerability scanning aims to identify any systems that are subject to known vulnerabilities, while a penetration test aims to identify weaknesses in specific system configurations and organizational processes and practices that can be exploited to compromise security.
- 6. Vulnerability management process This vulnerability management process involves: Identification of vulnerabilities Evaluation of the risk posed by any vulnerabilities identified Treatment of any identified vulnerabilities Reporting on vulnerabilities and how they have been handled
- 7. How it works A vulnerability scanner runs from the end point of the person inspecting the attack, to the surface in question. The software compares details about the target attack surface to a database of information about known security holes in services and ports, anomalies in packet construction, and potential paths to exploitable programs or scripts. The scanner software attempts to exploit each vulnerability that is discovered.
- 8. Types of Penetration testing Interbal and external Blackbox, Whitebox, Greybox Announced, Unannounced, Passive, Active scans Automated , Manual
- 10. Application Penetration Testing Application Penetration Testing is an "ethical attack" intended to reveal the effectiveness of an application's security controls by highlighting risks posed by actual exploitable vulnerabilities. Pure Hacking offers a number of application penetration testing services including: Web Application Penetration Testing Web Services Penetration Testing Mobile Application Penetration Testing Secure Code Review
- 11. Reporting structure From top Management Title page Executive summary For technical workers Title page Executive summary Test team Details Summary of vulnerabilities References Glossary
- 12. Content Executive Summary Scope of work Project objectives Assumption Timeline Summary of findings Summary of recommendation Methodology
- 13. Content (contd..) Planning Exploitation Reporting Detail Findings Detailed systems information Windows server information References Appendix
- 14. Conclusion This presentation is meant to share the importance of penetration testing on materials which is one of the non-destructive methods found in common. The impact of vulnerability assessment and its needs are broadly elaborated through this presentation. The types and the methodology involved in the penetration testing are elaborated. In final the reporting structure of penetration testing are also deeply discussed through this presentation.
- 15. References : https://www.offensive-security.com/reports/sample-penetration-testing-report.pdf https://partneredsolutionsit.com/importance-of-vulnerability-scans/ Books : Penetration testing :Ahands on introduction to hacking by Georgia Weidman, published by John wiley & sond Inc Penetration Testing for dummies by Robert shimonski , No starch press, San Francisco