Principles of Information Security: Penetration Testing Methodology (Recon, Exploitation, Post‑Exploitation, Reporting)

Penetration Testing Methodology (Recon, Exploitation, Post‑Exploitation, Reporting)

Penetration Testing Methodology Study Guide

(Reconnaissance, Exploitation, Post-Exploitation, Reporting)

What This Is

Penetration testing (pentesting) is a controlled, authorized simulation of a cyberattack to identify and exploit vulnerabilities in systems, networks, or applications before malicious hackers do. It follows a structured methodology to ensure thoroughness, repeatability, and actionable results. A real-world example: In 2021, the Colonial Pipeline ransomware attack (which caused fuel shortages across the U.S. East Coast) exploited weak remote access controls—a vulnerability that could have been caught in a pentest’s exploitation phase. Pentesting is critical because it validates security defenses, meets compliance requirements (e.g., PCI DSS, ISO 27001), and reduces the risk of costly breaches.

Key Terms & Concepts

• Penetration Testing (Pentest): A simulated cyberattack to evaluate security by actively exploiting vulnerabilities. Governed by standards like NIST SP 800-115 and PTES (Penetration Testing Execution Standard).
• Red Team vs. Blue Team:
• Red Team: Offensive security team simulating real-world attacks (e.g., phishing, lateral movement).
• Blue Team: Defensive team detecting and responding to attacks (e.g., SOC analysts, SIEM monitoring).
• Purple Team: Collaborative effort where Red and Blue teams share insights to improve defenses.
• Reconnaissance (Recon): The first phase of pentesting, gathering information about the target (e.g., IP ranges, employee emails, open ports). Divided into:
• Passive Recon: No direct interaction with the target (e.g., OSINT, Google Dorking, Shodan).
• Active Recon: Direct interaction (e.g., port scanning with Nmap, service fingerprinting).
• Exploitation: Using vulnerabilities (e.g., unpatched software, misconfigurations) to gain unauthorized access. Tools: Metasploit, Burp Suite, CrackMapExec.
• Post-Exploitation: Actions taken after gaining access, such as:
• Privilege Escalation: Gaining higher-level access (e.g., from user to admin).
• Lateral Movement: Moving across a network (e.g., using PsExec, Pass-the-Hash).
• Persistence: Maintaining access (e.g., creating backdoors, scheduled tasks).
• Proof of Concept (PoC): Evidence that a vulnerability is exploitable (e.g., a screenshot of a shell, stolen credentials).
• Tactics, Techniques, and Procedures (TTPs): MITRE ATT&CK framework categorizes adversary behavior (e.g., T1003: OS Credential Dumping).
• Rules of Engagement (RoE): A legal document defining pentest scope, authorized targets, and restrictions (e.g., "No DoS attacks on production servers").
• OWASP Top 10: A list of the most critical web application security risks (e.g., Injection, Broken Authentication).
• CVSS (Common Vulnerability Scoring System): Standardized scoring for vulnerabilities (0–10 scale; CVSS 9.8 = critical).
• Reporting: The final phase, documenting findings, risks, and remediation steps. Includes:
• Executive Summary: High-level overview for non-technical stakeholders.
• Technical Details: Step-by-step exploitation, screenshots, and evidence.
• Remediation Recommendations: Prioritized fixes (e.g., "Patch CVE-2021-44228 [Log4j]").

Step-by-Step / Process Flow

1. Planning & Scoping

• Define objectives: What’s the goal? (e.g., test external network, social engineering, web app security).
• Set scope: IP ranges, domains, systems (e.g., "Test 10.0.0.0/24, exclude HR database").
• Obtain written authorization: Sign Rules of Engagement (RoE) to avoid legal issues (unauthorized pentesting = hacking).
• Gather intel: Review past reports, network diagrams, and compliance requirements (e.g., PCI DSS, HIPAA).

2. Reconnaissance (Recon)

• Passive Recon:
• Use OSINT tools: theHarvester (emails), Maltego (relationship mapping), Shodan (exposed devices).
• Example: Find employee emails via LinkedIn to craft phishing attacks.
• Active Recon:
• Port scanning: nmap -sV -O 10.0.0.1 (service/OS detection).
• Vulnerability scanning: Nessus, OpenVAS (identify CVEs).
• Web app scanning: Nikto, OWASP ZAP (find misconfigurations).

3. Exploitation

• Prioritize vulnerabilities: Focus on CVSS ≥ 7.0 or those with public exploits (e.g., Metasploit modules).
• Exploit examples:
• EternalBlue (MS17-010): Exploit unpatched SMB (Windows) with msfconsole.
• SQL Injection: Use ' OR 1=1 -- to bypass login (test with sqlmap).
• Phishing: Send a malicious link via GoPhish to capture credentials.
• Gain initial access: Shell, RCE (Remote Code Execution), or stolen credentials.

4. Post-Exploitation

• Privilege Escalation:
• Linux: Check sudo -l, kernel exploits (e.g., DirtyCow).
• Windows: Use WinPEAS or Mimikatz (dump hashes).
• Lateral Movement:
• Pass-the-Hash: Use stolen NTLM hashes to move to other machines.
• PsExec: Execute commands remotely on Windows.
• Persistence:
• Cron jobs (Linux), Scheduled Tasks (Windows), or Golden Ticket (Kerberos).
• Data Exfiltration:
• Steal sensitive data (e.g., scp, curl, or DNS tunneling).
• Cover Tracks:
• Clear logs (e.g., wevtutil cl Security on Windows), delete temp files.

5. Reporting

• Structure:
• Executive Summary: Business impact (e.g., "Critical vulnerability in VPN could lead to ransomware").
• Methodology: Tools and techniques used (e.g., "Nmap, Metasploit, manual testing").
• Findings: Vulnerabilities ranked by CVSS (e.g., "CVE-2023-1234: CVSS 9.8").
• Evidence: Screenshots, PoCs, logs.
• Remediation: Step-by-step fixes (e.g., "Patch CVE-2023-1234, enable MFA").
• Deliverables: PDF report + debrief meeting with stakeholders.

Common Mistakes

Certification Exam Tips

CISSP

• Management vs. Technical: CISSP focuses on risk management and governance. Know how pentesting fits into risk assessment (e.g., "Pentests validate the effectiveness of controls").
• Legal/Compliance: Be ready for questions on RoE, CFAA, GDPR, or PCI DSS requirements for pentesting.
• Tricky Distinction: Vulnerability scanning (automated, passive) vs. penetration testing (manual, active exploitation).

Security+

• Tools: Know the purpose of Nmap, Metasploit, Burp Suite, Wireshark (but don’t memorize commands).
• Phases: Memorize the pentesting lifecycle (Planning → Recon → Exploitation → Post-Exploitation → Reporting).
• Common Question: "Which phase involves lateral movement?" → Post-Exploitation.

CEH

• Hands-On Focus: CEH tests tool usage (e.g., "Which Nmap flag performs OS detection?" → -O).
• Attack Techniques: Be familiar with MITRE ATT&CK (e.g., T1059: Command-Line Interface).
• Trick Question: "What’s the first step in a pentest?" → Planning/Scoping (not recon!).

Quick Check Questions

1. During a pentest, you discover an unpatched Apache Struts server (CVE-2017-5638). Which phase of the pentesting methodology does this fall under?

• A) Reconnaissance
• B) Exploitation
• C) Post-Exploitation
• D) Reporting Answer: A) Reconnaissance
  Explanation: Discovering vulnerabilities (even if they’re exploitable) is part of reconnaissance (vulnerability scanning). Exploitation comes later.

2. A pentester gains access to a Windows server and dumps hashes using Mimikatz. They then use these hashes to access other machines on the network. Which MITRE ATT&CK technique is this?

• A) T1003: OS Credential Dumping
• B) T1078: Valid Accounts
• C) T1550: Use Alternate Authentication Material
• D) T1021: Remote Services Answer: C) T1550: Use Alternate Authentication Material
  Explanation: Using stolen hashes (e.g., Pass-the-Hash) falls under T1550. T1003 is the dumping step, not the lateral movement.

3. Which document defines the scope, authorized targets, and legal boundaries of a pentest?

• A) Incident Response Plan
• B) Rules of Engagement (RoE)
• C) Business Impact Analysis (BIA)
• D) Risk Assessment Report Answer: B) Rules of Engagement (RoE)
  Explanation: The RoE is a legal contract outlining what’s allowed during a pentest (e.g., "No DoS attacks").

Last-Minute Cram Sheet

1. Pentesting Phases: Planning → Recon → Exploitation → Post-Exploitation → Reporting.
2. Recon Tools: Nmap (-sV, -O), theHarvester, Shodan, Maltego.
3. Exploitation Tools: Metasploit, Burp Suite, sqlmap, CrackMapExec.
4. Post-Exploitation: PrivEsc (WinPEAS, LinPEAS), Lateral Movement (PsExec, Pass-the-Hash), Persistence (Golden Ticket, Cron Jobs).
5. MITRE ATT&CK: Know T1003 (Credential Dumping), T1078 (Valid Accounts), T1550 (Pass-the-Hash).
6. CVSS: 0–10 scale; 7.0–8.9 = High, 9.0–10.0 = Critical.
7. OWASP Top 10: Injection, Broken Authentication, Sensitive Data Exposure.
8. RoE: Legal document defining pentest scope and rules. ⚠️ No RoE = Illegal hacking!
9. Ports to Know:
10. 22 (SSH), 80/443 (HTTP/HTTPS), 445 (SMB), 3389 (RDP).
11. Reporting Must-Haves: Executive summary, technical details, remediation steps, PoCs.