Penetration testing

Ruslan Rakhmetov, Security Vision

In one of our previous articles we told you about an ethical hacker: how he differs from others and how he can protect companies and the data of their employees, clients and partners. And now we will look at the part of his work called ‘penetration testing’ or ‘pentest’. We will tell you about the main stages of testing, as well as describe who and for what tasks pentesting may be interesting.

Penetration testing is a creative process and it can be conducted in different ways, but like other IS processes, it can be divided into main stages (for example, according to NIST):

1. defining the purpose of testing

The stage in which applications, networks, systems, and other resources under test are identified. Project constraints and specific security requirements are highlighted and described in this phase.

In fact, the goal definition phase is the signing of a contract for project work between a company and an ethical hacker. It can be compared to defining a study plan at the beginning of the year (when student workload, courses to be studied in the semester, and a set of exams and other tests are planned) or to making a treatment plan with possible budget constraints or due to drug allergies.

2. Information Gathering

In this phase, researchers gather information about the target system: the website and publicly available information about the company and employees is examined, open network ports are searched, information about the network infrastructure is collected, the technologies used are identified, etc. Information gathering can be passive or active, and other names for the second stage of the pentest can be found on the web - reconnaissance or reconnaissance.

In passive data collection, an ethical hacker does not interact with the target system (from step 1) directly, but simply monitors sites, domains, and studies publicly available information (e.g., whois queries). Active research methods include port scanning (e.g. Nmap scanner, which is used outside of penetration testing for asset and inventory management and other purposes), network and connectivity research, and even social engineering techniques when the researcher communicates with employees of the organisation.

In the context of penetration testing, reconnaissance helps to better understand the target environment and identify possible entry points for further testing phases. This stage can be compared to the way a doctor plans the treatment of a patient at the beginning: studying the available medical history from records (passive research) or communicating with the patient and his relatives with the completion of questionnaires and calculations (active research).

3. vulnerability analysis

Both automated scanner (as in vulnerability management) and manual source code analysis can be used to find vulnerabilities in applications or technical devices.

4. vulnerability exploitation

At this stage, the tester (tester, pentester) attempts to exploit the vulnerabilities found to demonstrate how an attacker can gain unauthorised access.

If we compare the current stage to a doctor's practice, as we did above, it would involve the doctor trying to induce another epilepsy attack (or other symptoms) to see for himself and show the patient the dangers of an uncontrollable disease.

5. Report

At the end of testing, a report is prepared that includes the vulnerabilities found, recommendations for fixing them, and an overall assessment of the system's security. This report will not only be a record of work performed, but also instructions for the customer on how to improve security within the perimeter. Additionally, repeat testing can be scheduled, for the ongoing cyclical development of security in the company.

In describing the steps of a pentest, we have used the analogy of a medical examination, but in reality there are many similar processes around us in life:

- Periodic fire drills to practise evacuation, safety and cohesion in the event of an emergency;

- A game of chess or dominoes when opponents test different tactics and look for ‘gaps’ in each other's defences;

- Material strength testing, where samples are compressed, twisted, stretched and damaged in various ways to determine the conditions where application will be most effective;

- Car crash tests to predict the risks in real accidents under safe conditions, where a special dummy is in the car instead of a person.

In any case, penetration testing itself is similar to the process of hacking, data theft and repeats its structure. The main difference is that the purpose of such testing does not include actual data theft and damage.

The testing process itself is undoubtedly creative and can take place in many different formats, such as:

- Physical testing, where the tester is in the perimeter physically, may be planting ‘infected’ thumb drives or attempting to hack the Wi-Fi in the office;

- Game-based testing, where teams of attackers and defenders (red/blue) compete against each other under conditions as close to the real world as possible to discover vulnerabilities and develop defence strategies. Such events attract both professionals and students participating for their own development, e.g. Standoff at PHdays, Black Hat briefings or Def Con.

- Applying machine learning to create personalised and effective attacks using social engineering or test automation.

Pentest is usually conducted in one of the modes (or a combination):

- White-Box, where the technician receives all the necessary configurations, has access to source code, documentation, architecture diagrams, and other data. In this format, vulnerabilities can be identified more accurately, but the process itself involves collaboration between the tester and other staff members.

- Black-Box, where access is granted only to external interfaces (e.g., web application or network) that are available to potential attackers at the outset. This format realistically simulates the actions of an attacker, but requires more time and skill from the tester.

Having learnt the basic stages of penetration testing, let's understand who will be interested and useful to conduct such work:

- IT companies and startups that develop software, web applications and other technologies conduct penetration testing to secure their products and protect their customers.

- Banks, insurance companies and other financial institutions handle a lot of sensitive information. Penetration testing helps protect their systems from cyber attacks and data breaches. The situation is similar for organisations in the healthcare system (medical information is extremely sensitive and its leakage can have dire consequences).

- Cloud service providers are responsible for the security of the data stored in the cloud, so for them, pentesting is a middle ground between the examples we described above.

- Large companies with extensive network infrastructures and multiple IT resources, as well as government organisations, conduct penetration testing to protect critical infrastructure and state secrets.