Introduction to Penetration Testing

 Penetration Testing involves finding vulnerabilities within a computer system or web application that can be potentially targeted by hackers, and suggesting ways in which this vulnerabilities can be blocked in order to avoid any future attacks.

It is important to note that Penetration Testing must be performed with prior permission (preferably written) from the owner if the target system. Otherwise you may be in legal trouble, if caught, as hacking is a crime in most countries.

The vulnerabilities that may occur on a system vary in complexity and the amount of damage that may be caused to the system. It may be something as  simple as a weak password that the attacker can guess to gain access to sensitive data, SQL Injection, XSS just to name a few. This are areas that I will cover in future posts.

In penetration testing, the core steps are:

• Reconnaissance

It invovles gathering as much information as possible about a potential target before any attack takes place. There are various methods by which an attacker can gain valuable information many of which are publicly available and can be accesed by anyone. The information gathered includes but is not limited to, phone numbers and email addresses on websites that can be used for social engineering, url analysers that can reveal the structure of a website, eaves dropping on employees of a specific company to find some information on the inner workings of the organiztion and shoulder surfing to try and see passwords that a person may type into their computer.

• Scanning

Vulnerabilitites and posiible attack vectors are identified in this phase. The attacker actively probes the target system to identify any security weakness that may be present and that can be expoited to achieve the end goal of the attacker. Weaknesses can include, easily accessible administrator pages with default/easy passwords and  suceptability to SQL injection.

• Gaining Access
• Vulnerabilities identified in the previous phase are used by the attacker to gain access to the target system. The attacker will try each one of the vulnerabilities to see which one will work and allow him to gain priviledged acccess to the system. Multiple attack vectors may be used to end up with a successfull attack.

• Maintaining Access
• Once the attacker has priviledged access on the target, they would need to maintain this access for future access to the system. Thee attacker would not want their activities to be detected and therefore would want to get rid of any evidence that an attack has taken place. This usually involves clearing log files. The compromised system can now be used to perform attacks on other system.

A penetration tester would keep a log of all this activities and create a documentation to show that this vulnerabilities are present and how they can be fixed in order to prevent a potential attacker from acessing the system with the same or simmilar techniques.

In this blog I will be going through various aspects penetration testing protecting and protecting ine self from this vulnerabilities and hopefully add something useful  to anyone who chooses to read.

Sources:
https://www.redteam-pentesting.de/en/pentest/
https:www.veralab.com