Penetration Testing Summary

Penetration Testing Summary

1. Penetration Testing Overview

Penetration Testing (penetration test) does not have a standard definition, some foreign security organizations to reach a consensus of common argument is: penetration testing is simulated attacks by malicious hackers, to assess the security of computer network system for evaluating the method. This process includes any system weaknesses, technical flaws or vulnerabilities proactive analysis, this analysis is from a position of possible attackers carried out, and from this position conditionally active exploit security vulnerabilities.
　　
Assuming that there are security risks of a company's information systems operation and maintenance suspect, but because of the ability to not have professional security attack and defense, what are the specific risks are not clear. Then you can entrust security penetration testing company to the company information system. In other words, penetration testing team put myself into a simulated hacker to carry out various forms of attack on the target information system (of course, such attacks are legitimate because the attack early access to authorized parties), and finally the submission process of attack and vulnerability discovery, and vulnerability remediation solutions to customers, so that customers can improve the security of their own information systems.
　　
In information security knowledge systems, penetration testing accounted for the highest proportion of a part, it is one of the highest part of the individual technical skills and ability to comprehend the requirements. Process penetration test can not simply rely on the fixed attack learned to test engineers need to be tested in accordance with different target environments, a variety of conventional or non-conventional approach to attempt; attack objects and attack also entry points It may be more than the computer system, and may even be cut to (social engineering) directly from the user's computer.

1.1 Classification of penetration testing

Penetration testing is generally divided into black box testing white box and gray box testing. Different customers may choose different ways to test for different needs.

• Black Box Testing: Testers refers to the target information system ignorant of the need to collect information from the very beginning to start step by step, more difficult, higher capacity requirements for testers. However, due to customer testers can not know in what way will be to attack and invasion, it is possible to detect network intrusion prevention and emergency response systems are effective. This test costs way too high.

• White-box testing: refers to the testers have been informed in advance a variety of information about the target information systems, it can be tested faster, lower cost, generally used for testing internal staff or daily leak inspection sweep.

• Gray box testing: white box and black box testing basic types of combination, it can provide more in-depth and comprehensive security review of the target system. After the combination of benefits is the ability to simultaneously serve two respective advantages penetration testing methods. In gray box testing method using the external penetration attack scenarios, penetration testers similarly need to gradually penetrate into the goal from outside the network, but he has the underlying goal of the network topology and architecture will contribute to better decision-making ways and means to attack , so as to achieve better penetration test results.

1.2 Penetration Testing Process

• Early interaction: Before making penetration testing, penetration testing team needs goals with the customer penetration testing, penetration testing range, penetration testing mode (white box, black box, gray box and is involved in social engineering, DDOS, etc.), service contracts, etc. details deliberations, consensus agreement.

• Information Collection: After determining the objectives and scope of penetration testing, then you need to enter the information gathering phase. At this stage, penetration testers need to use a variety of public resources to obtain information related to the test target as possible. You can make use of various channels to collect objective information, including public channels and private channels. Information gathering is an important prerequisite for the development of back programs and plans of attack

• Threat Modeling: penetration testing team needs to gather information together to get to this stage in the analysis and to plan attacks. This is a penetration testing process is very important but very easily overlooked a key point. In this process we must clarify ideas, to determine the most effective and feasible attack scenarios. In short, this stage is to develop the best possible plan of attack based on the information collected to the front

• Vulnerability Analysis: With a plan of attack, but the specific implementation where to cut the entire program, you need a point of attack. All attacks and intrusions are based on the vulnerability of the information system, so those who need to test the stage as much as possible to dig out the loopholes in the system. And not only need to verify that the system for known vulnerabilities, but also need to dig some potential loopholes in the system, and develop the appropriate exploit code.

• Penetration attacks: The implementation phase is the real attack. According to the previous plan developed to find the entry point of attack, attack and invade a step by step to get top management target information system for the ultimate goal

• After penetration attacks: After the attack, the tester has obtained the highest management of the target system, but truly reflect the value of the test is often the stage after penetration. This phase of testing needs to use various means to locate high-value target information system assets, and to find the means to affect the value of assets, the implementation of the objectives of the fight against people and destruction. The stage will leave the back door, to maintain and achieve long-term control authority

• Reports penetration: penetration testing the entire process will eventually need to be submitted to the customer in the form of a written document, this report is, we often say that the penetration test report. This report covers a variety of valuable information and to probe and dig out all the relevant security vulnerabilities in previous phases of penetration testing team acquired, the process of a successful attack, the consequences and the impact on the business analysis. But also on the vulnerabilities present in the system, given the existence of security problems repair is recommended at this stage.