‫A penetration test briefly consists of five phases.
‫Reconnaissance.
‫Now that's the act of gathering preliminary data or intelligence on your target.
‫The data is gathered in order to better plan for your attack.
‫The phase of scanning requires the application of technical tools to gather further intelligence on
‫your target.
‫But in this case, the intel being sought is more commonly about the systems that they have in place.
‫A good example would be the use of a vulnerability scanner on a target network.
‫Exploitation.
‫That's the phase that's also known as gaining access, it requires taking control of one or more network
‫devices in order to either extract data from the target or who use that device to then launch attacks
‫on other targets.
‫The purpose of the post exploitation phase is to determine the value of the machine compromised and
‫to maintain control of the machine for later use.
‫The value of the machine is determined by the sensitivity of the data stored on it and the machine's
‫usefulness and further compromising the network.
‫Now covering tracks simply means that the attacker must take steps necessary to remove all semblance
‫of detection.
‫Any changes that were made, authorizations that were escalated, et cetera, all must return to a state
‫of non-recognition by the host networks administrators.
‫Reporting is the proof of your actions performed during the pen test.
‫It's where you're going to report the findings and share recommendations to remediate the vulnerabilities
‫and weaknesses.
‫So let's have a look at these phases in detail.
‫Reconnaissance.
‫As you already know, it's the act of gathering preliminary data or intelligence on your target.
‫The data is gathered in order to better plan for your attack.
‫The success of the pen test depends on the accuracy of your reconnaissance.
‫A pen tester works on gathering as much intelligence on the client organization and the potential targets
‫for exploit as possible.
‫We can classify the scanning activities into two main parts.
‫Network skin is used to discover devices such as end user computers, servers and peripherals that exist
‫on a network.
‫Results can include details of the discovered devices, including IP addresses, device names, operating
‫systems, running applications and services.
‫Open shares, usernames and groups.
‫Since we gather information about the network and system, this process is often related to the reconnaissance
‫phase as well.
‫A vulnerability scan detects and classify system weaknesses in computers, networks and communications
‫equipment and predicts the effectiveness of countermeasures.
‫Now, since there are thousands of different systems and services, we should perform thousands of analyses
‫to understand whether or not a service has vulnerabilities and the vulnerability scanners are used to
‫automate this process makes your job a whole lot easier.
‫Exploitation.
‫That's the phase that requires taking control of one or more network devices in order to either extract
‫data from the target or to use that device to then launch attacks on other targets.
‫The purpose of the post exploitation phase is to determine the value of the machine compromised and
‫to maintain control of the machine for later use.
‫The value of the machine is determined by the sensitivity of the data stored on it and the machine's
‫usefulness in further compromising the network.
‫Now I've got your attention.
‫The final phase before reporting is covering your tracks.
‫It's basically returning everything to the initial state.
‫The state before the pen test.
‫Now, since you have limited time to perform the pen test, you might ask the system owner to define
‫some privileges and exceptions for you.
‫If so, you should remind them to remove these exceptions at the end of the pen test.
‫And in addition, you will probably make a lot of changes during the pen test, such as adding a new
‫user to the domain admin group or create a backdoor into a compromised system for later use.
‫It's very important to remove all these changes at the end of the pen test.
‫Otherwise, the Black Hat hackers can compromise the systems using these modifications.
‫The report is the fruit of the pen test.
‫It's the outcome of the actions you performed threw out the pen test pen test report typically consists
‫of the following sections An introduction.
‫What's the purpose, the scope and the duration of the test?
‫A management summary, the screenshot of the IT system to show how vulnerable it is.
‫The findings section that lists all of the vulnerabilities found during the pen test and the recommendations
‫section includes just how the owner can harden the system.
‫That was obviously the findings is going to be the most important section of the Penn test report,
‫especially to the owner.
‫The system owner will see the weaknesses here and remediate them according to your recommendations,
‫so you should give at least the following details about the findings.
‫A short name of the vulnerability to give brief information about it.
‫The severity level of the vulnerability that will help the system owner to triage the remediation process.
‫The list of vulnerable assets, which assets in particular have this vulnerability?
‫A detailed explanation of the vulnerability to show the possible consequences.
‫A brief summary of how you identified the vulnerability.
‫And support this section with screenshots wherever possible.
‫Recommendations to remediate or at least mitigate the vulnerability.
‫And finally, share the references about the vulnerability to let the system owner find out more about
‫it.