‫Now, to understand what we'll do throughout the course, I think it's better to start to learn the
‫exploitation concept and the terminology.
‫So literally an exploit should be defined as a piece of software or a sequence of command that takes
‫advantage of a vulnerability to cause unintended or unanticipated behavior to occur on computer software
‫or hardware.
‫But I'd like to explain it in these words and exploit is an attack on a computer system, especially
‫one that takes advantage of a particular vulnerability the system has.
‫Such behavior frequently includes things like gaining control of a computer system, allowing privilege
‫escalation or a denial of service attack.
‫Used as a verb, exploit refers.
‫To the act of successfully making such an attack.
‫Now you heard me use the word vulnerability.
‫I think we should clarify that one.
‫A vulnerability is a flaw or weakness in systems designed implementations or internal controls that
‫could result in a security breach or a violation of the system security policy.
‫In the context of cyber security, the payload is the portion of the malware which performs malicious
‫action and exploit is used to run a payload on the target.
‫The things we could do on the target depend on the payload.
‫A payload may give you a shell at the target.
‫And access to the passwords stored on the target computer.
‫A back door on the target, etc..
‫Payloads are usually written in assembly language, and they are usually platform dependent.
‫In other words, you may not use a payload written for Windows on a Linux system.
‫So let's explain the vulnerability, exploit and payload terms with an example.
‫Here we have a missile.
‫And here is the target.
‫Well, I think the vulnerability is obvious.
‫An umbrella wouldn't be enough to protect the guy, right?
‫Missile with a rocket fuel.
‫Everything else.
‫And then it has a warhead on top that does the actual damage.
‫So the missile is the delivery system, and that's the exploit, the warhead is the payload that actually
‫does something to the target.
‫All right, so because you force the systems to work in unintended ways, there are always some risks
‫while performing penetration tests.
‫And it's probably obvious, but exploitation and post exploitation phases are the most risky parts of
‫any penetration test.
‫We can classify the risks as follows.
‫Especially the legacy systems and custom applications may be taken offline by an automated vulnerability
‫scanner or over abuse by the attacker.
‫Likewise, servers may be out of service.
‫Based on the amount of the automated scanning, the size of the network pipes and a number of ports
‫on a particular system, it's possible to overwhelm a service or medium, resulting in performance loss.
‫You may unintentionally or intentionally cause configuration changes while trying to exploit a vulnerability.
‫Now, it's very common for a penetration tester to access the confidential data of the institute.
‫So watch out, please be very careful with the data that you collect.
‫And you may have some tunnels or back doors, especially in post exploitation.
‫It's a big risk to forget to clean them up at the end of the penetration test, but don't worry, all
‫the exploitations and post exploitations will perform run at the memory of the target systems, so the
‫back doors or the tunnels are deleted when you shut down the systems.
‫So to help mitigate the risks, many approaches can be taken, and I'll give you a few examples.
‫Exclude legacy systems and custom applications from automated testing to ensure security, perform manual
‫testing of excluded items.
‫Perform testing of critical systems during off hours, critical systems can be scheduled for testing
‫during low volume business or off business hours.
‫Perform testing in a phased manner, starting with user acceptance, testing U80 environments to ensure
‫the actual test do not affect particular systems or networks.
‫Once that is complete, then begin testing on production environments.
‫Set up monitoring and escalation procedures prior to testing.
‫And her fault management is in place to ensure systems send alerts when they go down.
‫Ensure proper phone numbers and other contact information is defined to immediately investigate and
‫restore services in the event of a problem.
‫Escalation procedures should include contact information for the person performing the test so they
‫can immediately stop all testing if required.
‫Now you've got to throttle back automatic testing to use less bandwidth to help prevent bandwidth issues.
‫Also, the number of ports can be reduced if there's a concern for overloading a particular group of
‫systems.
‫Usually, it's recommended to test the u8e environment instead of reducing the number of ports because
‫certain vulnerabilities may be missed.
‫And always have a cleanup procedure to reverse the modifications of configurations to delete users created
‫during the test, to remove the back doors, et cetera, et cetera, the exploits and the payloads that
‫the exploitation frameworks use work in the memory in general, and that means they are not permanent
‫and the backdoors and tunnels are terminated when the memory is cleaned.