Vulnerability Assessment and Penetration testing

$7absec
https://7absec.dorik.io
Date: 28th September 2022
11am - 1pm (Wednesday)
-- Aftab Harun
($7absec)
-- Cybersecurity Researcher
An ethical way of hacking

$7absec
What is Pentesting
VA v/s PT
Pentest Engagement
Methodology
Work of scope
Conclusions
11:10 AM
11:20 AM
11:40 AM
12:25 PM
12:35 PM
12:50 PM
Image source — https://www.subpng.com/png-4ek66c/

$7absec
 A penetration testing is an authorized simulated
attack performed on a computer system to evaluate
its security
Image source — https://rhinosecuritylabs.com/assessment-services/red-team-engagement/
 Penetration testers use the same tools, techniques, and
processes as attackers to find and demonstrate the
business impacts of weaknesses in a system.
 Penetration tests usually simulate a variety of attacks
that could threaten a business.
 With the right scope, a pen test can dive into any aspect
of a system.

$7absec
 Vulnerability Assessments tend to be
wide in coverage but narrow in scope.
 Penetration Testing take vulnerability
assessments to the next level by
exploiting and proving out attack paths.
Credit —Image credit goes to respective creator

$7absec
 Every pentesting engagement will start by defining
clear goals
 Pentest engagements also improve on regular
vulnerability assessments by exploiting vulnerabilities
 Depending on the resources available, the pentest
exercise can be run in tow ways -
 Network based
 Host based

$7absec
 We follow the following pen testing methodology
 Reconnaissance
 Automated Testing
 Exploration and Verification
 Assessment Reporting
 Optional Remediation

$7absec
Reconnaissance
 This process begins with detailed scanning and
research into the architecture and environment, with
the performance of automated testing for known
vulnerabilities.
 Different methods are used to evade the firewall and
IDS during the intelligence gathering.
 During reconnaissance the Live Hosts discovery and
Network/Port scanning activities are carried out.

$7absec
Automated Testing
 Once the target has been fully enumerated,
MapleCloud Technologies uses both vulnerability
scanning tools and manual analysis to identify security
flaws.
 With decades of experience and custom-built tools,
our security engineers find weaknesses most
automated scanners miss.
 The results of automated tools are analyzed to filter
out the false positives.
 The vulnerabilities identified by automated tools are
manually verified by our security engineers.

$7absec
Exploration and Verification
 At this stage of the assessment, our consultants
review all previous data to identify and safely exploit
identified application vulnerabilities
 Once sensitive access has been obtained, the focus
turns to escalation and movement to identify technical
risk and total business impact.
 During each phase of the compromise, we keep client
stakeholders informed of testing progress, ensuring
asset safety and stability.

$7absec
Assessment Reporting
 Once the engagement is complete, MapleCloud
Technologies delivers a detailed analysis and threat
report, including remediation steps.
 Our consultants set an industry standard for clear and
concise reports, prioritizing the highest risk
vulnerabilities first.
 The assessment includes the following:
• Executive Summary
• Strategic Strengths and Weaknesses
• Identified Vulnerabilities and Risk Ratings
• Detailed Risk Remediation Steps
• Assets and Data Compromised During Assessment

$7absec
Optional Remediation
 As an optional addition to the standard assessment,
MapleCloud Technologies provides remediation
retesting (Revalidation) for all vulnerabilities listed in
the report.
 At the conclusion of the remediation testing and
request of the client, MapleCloud Technologies will
update the report with a new risk level determination
and mark which vulnerabilities in the report were in
fact remediated to warrant a new risk level.

$7absec
 We followed the Network based Vulnerability Assessment approach.
 The Methodology will differ for the different IT assets.
Elements Approach
Network Devices (switch, router, firewall) Configuration Review
Servers (Virtual, Physical (DC, DR)) Network Based VAPT
Web Application WebApp VAPT
SDWAN Configuration Review
Mobile Applications Static and Dynamic Testing (source code review)

$7absec
 A penetration testing is one of the best ways to expose
potential vulnerabilities in your system.
 This can be in relation to a cloud database, an in-house
service or any form of tech system you're operating on.
 This ability to expose vulnerabilities is vital to ensuring
that your system is as secure as it possibly can be.
Image source — https://www.nicepng.com/ourpic/u2q8r5r5a9w7e6e6_graphic-freeuse-stock-conclusion-clipart-planning-planning-transparent/

$7absec
 For online consulting visit
 Or mail us on
7absec@gmail.com

$7absec
Questions/Suggestions…

Vulnerability Assessment and Penetration testing

More Related Content

What's hot (20)

Similar to Vulnerability Assessment and Penetration testing (20)

Recently uploaded (20)

Vulnerability Assessment and Penetration testing