Penetration Testing

what is pen test?

Pivoting the found vulnerabilities by exploiting them to identify whether it is a genuine vulnerability (true- positive) or not (false-positive).PenTest simulates like that of an adversary with the intent to remediate and know the attack vectors of the adversaries.

Types

of Pen Test



Network PT

Penetrate the Perimeter of the Network
to know the secure architecture in the topology.



Server PT

Analysing the Defense-in-depth of the servers from the
adverserial view.



Mobile App PT

Secure mobile apps to outsmart experienced adversaries.



Webapp PT

Reviewing the Webapp Security by performing WebAppPenTest
to fill the security gaps.



External PenTest

Know the attacker’s intent from the external adversary’s views.



Internal PenTest

Know the attacker’s intent from the insider adversary’s views.

Phases of

PenTest

Penetration Testing (PT) or Ethical Hacking involves various phases and is very much similar to the military operation. The information collected in one phase will carry forward in another phase.

Reconnaissance

It is the predatory phase of an attacker seeking to gather the information about a target before propelling an attack. It is the phase where we strategise the attack vectors.





Scanning

Scanning refers to the pre-attack staging when the critic scans the network of systems for precise information by information gathering during recon. Vulnerability scanners, Network Mappers, so on & so forth.

Gaining Access

It refers to the point where that attacker obtains access to the operating system or applications on the computer or network.





Escalate Privileges

The attacker can elevate privileges to gain excellent command of the system. Password Cracking, Buffer Overflows, Denial of Service (DoS), Session Hijacking so on & so forth.

Maintaining Access

It is when the attacker tries to retain their possession of the system. They may also prevent the system from being owned by other attackers by securing their exclusive access with Backdoors, Rootkits, or Trojans.





Clearing Tracks

The actions conducted by an attacker to hide malicious acts. The attacker's plans entail uninterrupted access to the victim’s system, prevailing ignored & uncaught, erasing proof that might influence to their undertaking. They may even overwrite the server logs to evade.



Red Team

Aggressive everywhere & uses multiple attack vectors.



purple team

Combo of both Red (PenTest) & Blue Team (IT Sec)



Blue Team

IT Security Team to evade the Red Team activities.