Case study: An ethical approach to hacking

What is Penetration Testing?

• Authorized simulated attack on a system to evaluate its security.

• Unauthorized system hack to steal data

• Software update process

• Firewall configuration

What is the Penetration Testing Execution Standard (PTES)?

• A structured 7-phase framework for conducting penetration tests.

• A firewall configuration guide

• An encryption algorithm

• A malware removal process

What are Pre-engagement Interactions in PTES?

• Phase 1: Defining goals, scope, and rules of engagement with the client.

• Phase 2: Scanning for open ports

• Phase 7: Writing the final report

• Phase 5: Exploiting vulnerabilities

What is Intelligence Gathering in pentesting?

• Phase 2: Collecting publicly available data about the target (e.g. OSINT).

• Phase 4: Patching systems

• Phase 6: Escalating privileges

• Phase 1: Signing contracts

What is Threat Modelling?

• Phase 3: Identifying potential threats, attackers, and methods of exploitation.

• Mapping network topology visually

• Cracking passwords

• Performing DNS lookups

What is Vulnerability Analysis?

• Phase 4: Detecting weaknesses that could be exploited.

• Deploying patches across systems

• Reviewing legal contracts

• Encrypting sensitive data

What is Exploitation in pentesting?

• Phase 5: Actively attempting to breach systems using known vulnerabilities.

• Writing the final report

• Only passive data collection

• Designing user training

What is Post-Exploitation?

• Phase 6: Assessing what happens after access is gained, including privilege escalation.

• Initial reconnaissance only

• Deleting logs immediately

• Designing network diagrams

What is Reporting in PTES?

• Phase 7: Documenting findings, vulnerabilities, and providing recommendations.

• Launching malware

• Scanning for open ports

• Password cracking

What is Black Box Testing?

• Testing with no prior knowledge of the system, simulating an external hacker.

• Testing with full internal documentation

• Testing only source code

• Testing using test accounts provided by IT