This post describes the key phases in the life cycles of Vulnerability Assessment and Penetration Testing. These life cycles are almost identical; Penetration Testing involves the additional step of exploiting the identified vulnerabilities.
It is recommended that you perform testing based on the requirements and business objectives of testing in an organization, be it Vulnerability Assessment or Penetration Testing. The following stages are involved in this life cycle:
2. Information gathering
3. Vulnerability scanning
4. False positive analysis
5. Vulnerability exploitation (Penetration Testing)
6. Report generation
The following figure illustrates the different sequential stages recommended to
follow for a Vulnerability Assessment or Penetration Testing:
Stage 1 – Scoping
Scoping is the primary step of any security assessment activity. In order to execute a VA or PenTest, the first step is to identify the scope of the assessment in terms of infrastructure against which the assessment is to be conducted, for example, servers,network devices, security devices, databases, and applications.
Scoping depends on the business objective of the Vulnerability Assessment. During the scoping, a scanning window should also be agreed upon. Also, the types of attacks that are permitted should be agreed upon. After deciding on the scope of assessment, this phase also includes planning and preparation for the test, which includes deciding
on the team, date, and time of the test.
Another major factor that should be taken care of prior to beginning the engagement is signing a formal engagement agreement between the security tester and the party on whose infrastructure these tests will be performed. Scoping should also include identifying the count of infrastructure elements to be tested.
Apart from the infrastructure scope and other program management modalities, the exact scope, the organization’s approach to the business objective, and the methodology of the assessment should be decided. For deciding on the business objective, the organization should identify the type of attack that it would like to get mimicked.
An example of an objective that a company might seek is: “To find out what an external attacker can achieve by targeting externally exposed infrastructure with only the knowledge of a publicly exposed IP address.” This type of requirement will be met through an external Black box penetration testing of infrastructure and applications,
and the approach and the methodology should be in accordance with that.
Based on the accessibility of infrastructure from the Internet or intranet, the testing can be done from an external or internal network. Also, based on the type of details, the infrastructure testing can be Black box or Grey box. And depending on the type of infrastructure, the plugins or features of a vulnerability scanning tool should be enabled, aided by appropriate manual checks.
Stage 2 – Information gathering
Information gathering is the second and most important stage of a VA-PT assessment. This stage includes finding out information about the target system using both technical (WhoIS) and nontechnical passive methods such as the search engine.
This step is critical as it helps in getting a better picture of the target infrastructure and its resources. As the timeline of the assessment is generally time bound, information captured during this phase helps in streamlining the effort of testing in the right direction by using the right tools and approach applicable to target systems.
This step becomes more important for a Black box assessment where very limited information about the target system is shared. Information gathering is followed by a more technical approach to map the target network using utilities such as pings and Telnet and using port scanners such as NMAP. The use of such tools would enable assessors to find a live host, open services, operating systems, and other information.
The information gathered through network mapping will further validate information gathered through other passive means about the target infrastructure, which is important to configure the vulnerability scanning tool. This ensures that scanning is done more appropriately.
Stage 3 – Vulnerability scanning
This stage involves the actual scanning of the target infrastructure to identify existing vulnerabilities of the system. This is done using vulnerability scanners such as Nessus. Prior to scanning, the tool should be configured optimally as per the target infrastructure information captured during the initial phases.
Care should alsobe taken that the tool is able to reach the target infrastructure by allowing access through relevant intermediate systems such as firewalls.
Such scanners perform protocol TCP, UDP, and ICMP scans to find open ports and services running on the target machine and match them to well-known published vulnerabilities updated regularly in the tool’s signature database if they exist in the target infrastructure.
The output of this phase gives an overall view of what kind of vulnerabilities exist in the target infrastructure that if exploited can lead to system compromise.
Stage 4 – False positive analysis
As an output of the scanning phase, one would obtain a list of vulnerabilities of the target infrastructure. One of the key activities to be performed with the output would be false positive analysis, that is, removing any vulnerability that is falsely reported by the tool and does not exist in reality.
All scanning tools are prone to report false positives, and this analysis can be done using methods such as
correlating vulnerabilities with each other and previously gathered information and scan reports, along with actually checking whether system access is available.
Vulnerability scanners give their own risk rating to the identified vulnerabilities; these can be revisited considering the actual criticality of the infrastructure element (server or network device) to the network and impact of the vulnerability.
Stage 5 – Vulnerability exploitation (Penetration Testing)
In case system owners require proof of existing vulnerabilities or exploits to understand the extent to which an attacker can compromise a vulnerable system, testers will be required to demonstrate exploits in a controlled environment with out actually making the infrastructure unavailable, unless that’s a requirement.
Penetration Testing is the next step to Vulnerability Assessment aiming to penetrate the target system based on
exploits available for the identified vulnerabilities. For exploitation, our own knowledge or publicly available exploits of well-known vulnerabilities can be utilized.
Penetration Testing or Vulnerability Exploitation can be broadly divided into phases such as pre exploitation, exploitation, and post exploitation.
Activities in the pre-exploitation phase are explained in phases 1 to 4, that is, enumerating the infrastructure and identifying the vulnerability.
Once any vulnerability is exploited to gain access to the system, the attacker should aim to further detail the network by sniffing traffic, mapping the internal network, and trying to obtain a higher privilege account to gain the maximum level of access to the system.
This will enable testers to launch further attacks on the network to further increase the scope of compromised systems.
The post exploitation step will also involve clearing of tracks by conducting activities such as clearing logs and
disabling antivirus.As a post-exploitation phase tester, you can demonstrate how an attacker can
maintain access to the system through backdoors and rootkits.
Stage 6 – Report generation
After completing the assessment as per the scope of work, final reporting needs to be
done covering the following key areas:
• A brief introduction about the assessment
• The scope of assessment
• The management/executive summary
• A synopsis of findings with risk severity
• Details about each finding with their impact and your recommendations to
fix the vulnerability.