Krishna Kickoff Meeting Unless a black box test is called for, it is important to schedule and attend a kickoff meeting, prior to engaging with the client. This is your opportunity not only to confirm your understanding of the client’s needs and requirements but also to get off on the right foot with the client. It … Read more
When performing penetration tests, the signed agreements you have in place may be your best friend or worst enemy. The following documents apply. Statement of Work Most organizations use a Statement of Work (SOW) when contracting outside work. The format of the SOW is not as important as its content. Normally, the contractor (in this … Read more
There are several well-known penetration testing methodologies and standards. OWASP The Open Web Application Security Project (OWASP) has developed a widely used set of standards, resources, training material, and the famous OWASP Top 10 list, which provides the top ten web vulnerabilities and the methods to detect and prevent them. OSSTMM The Open Source Security … Read more
The organization of the penetration testing team varies from job to job, but the following key positions should be filled (one person may fill more than one position): • Team leader • Physical security expert • Social engineering expert • Wireless security expert • Network security expert • Operating System expert
Determining the locations in scope is critical to establishing the amount of travel and the level of effort involved for physical security testing, wireless war driving, and social engineering attacks. In some situations, it will not be practical to evaluate all sites, but you need to target the key locations. For example, where are the … Read more
Scope is probably the most important issue when planning a penetration test. The test may vary greatly depending on whether the client wants all of their systems covered or only a portion of them. It is important to get a feel for the types of systems within scope to properly price out the effort. The … Read more
Types of Penetration Tests There are basically three types of penetration testing: white box, black box, and gray box. White Box Testing White box testing is when the testing team has access to network diagrams, asset records, and other useful information. This method is used when time is of the essence and when budgets are … Read more
Metasploit is a free, downloadable framework that makes it very easy to acquire, develop, and launch exploits for computer software vulnerabilities. It ships with professional-grade exploits for hundreds of known software vulnerabilities. When H.D. Moore released Metasploit in 2003, it permanently changed the computer security scene. Suddenly, anyone could become a hacker and everyone had … Read more
The BackTrack developers maintain a repository of the latest version of all tools contained in the distribution. You can update BackTrack tools from within BackTrack using the Advanced Packaging Tool (APT). Here are three useful apt-get commands: You can show all packages available, a description of each, and a version of each using the dpkg … Read more
We have now demonstrated two of the nine options in the default BackTrack boot menu. The first option boots with desktop resolution 1024×768, and the fifth option boots in persistent mode with changes written out to and read from a casper file system. Let’s take a closer look at each of the boot menu options … Read more