All language subtitles for 005 PenTest Methodologies (OBJ 1.2)

Instructor: Every penetration test

should follow a specific methodology.

Now, a methodology is defined as a system of methods

used in a particular area of study or activity.

In terms of penetration testing,

it refers to the systematic approach

that a penetration tester is gonna use before,

during, and after a test, assessment, or engagement.

Now notice I use three different terms here

to talk about a penetration test.

This is the term test, assessment, and engagement.

All three of these are often used interchangeably

both on the exam and in the industry.

And you're gonna notice I use all three interchangeably

throughout this course as well.

A methodology is simply a structured approach

to penetration testing with each step working to serve

a unique purpose as you try to identify

and exploit various vulnerabilities on a given system.

There are many different penetration testing

methodologies available,

but the one this course is built around

is the Comp TIA penetration testing process

which includes four major steps or phases

that occurred during an engagement.

First, we have planning and scoping.

Second, we have information gathering

and vulnerability scanning.

Third, we have attack and exploit.

And fourth, we have reporting and communicating.

In fact, you may have noticed

that these four steps match up perfectly

with the first four domains of the PenTest+ exam.

The fifth domain tools and code analysis doesn't fit cleanly

into a single phase though,

because we're gonna use different tools and code

during all of the phases of a penetration test.

Now, there are many other methodologies

that a penetration tester can utilize

when they're conducting their own assessments,

and many have more steps since they're dividing

up portions of the four phases that we just covered.

For example, EC council presents an eight step model

in their certified ethical hacker

or CEH certification program.

This involves permission, reconnaissance,

scanning and enumeration, gaining access,

escalation of privileges,

maintaining access, covering your tracks

and installing back doors, and of course, reporting.

Even though the EC council methodology

might seem to be more in depth,

both methodologies are fairly equivalent.

For example, the permission phase from CEH

parallels the planning and scoping stage from PenTest+.

The reconnaissance scanning and enumeration steps

are gonna be combined from CEG

into the information gathering

and vulnerability identification inside of PenTest+.

Whereas your attack and exploit phase inside PenTest+

is actually broken down into several steps in CEH,

including gaining access,

escalation of privileges, maintaining access,

covering your tracks, and installing back doors.

Finally, the reporting and communication phase

that we have in PenTest+

is covered under reporting inside of CEH.

As you can see, these similar methodologies

only really differ by the amount of specification

by combining or splitting apart different steps.

For this reason, the PenTest+ methodology

does tend to be a little bit easier to learn and implement

in the real world because it is only four steps.

Now, regardless of whether you follow

the CompTIA four-step process,

or the CEH eight-step process,

it's important to remember that this is essentially

the same steps that are being taken

by a threat actor or unauthorized hacker

when they attempt to break into your systems.

The only real difference is

that that threat actor doesn't ask

for permission during the planning and scoping,

and they don't bother to report or communicate

to you about the exploits that they're able to achieve

against your given vulnerabilities.

Now, CompTIA and CEH are not the only two methodologies

that are out there though.

For example, the National Institute

of Standards and Technology known as NIST

has their own methodology that's published

in the NIST special publication 800-115

known as the Technical Guide

to Information Security Testing and Assessment.

This publication provides a recommended methodology

for conducting penetration tests

utilizing a four phase approach of plan,

discover, attack, and report.

And this methodology seems to be what CompTIA designed

their methodology upon,

because it clearly matches up to the four steps

of the PenTest+ methodology.

The NIST methodology is the industry standard use

throughout the entire United States,

especially, in the federal government

and the Department of Defense

for all their internal assessments.

Now, sometimes when you're conducting an engagement,

you're gonna be asked to do

what is known as adversary emulation.

Adversary emulation is a specialized type

of penetration test where you're trying to mimic

the tactics, techniques, and procedures

of a real world threat actor in your penetration test.

For example, maybe you're conducting a penetration test

against a company that's gonna be expanding their operations

into a new market, and they're worried that

a nation state advanced persistent threat

might wanna hack their networks.

In this case, they may wanna train

their cyber security analyst

on what that type of attack is gonna look like

by having you conduct a penetration test

using the techniques associated

with a specific threat actor.

If you ever find yourself in this situation,

you should definitely check out the MITRE ATT&CK framework

when you research a specific threat actor.

Now, unlike the methodologies we discussed earlier

in this lesson, the MITRE ATT&CK framework

is a knowledge base that's maintained

by the MITRE Corporation

for the listing and explaining of common adversary tactics

and techniques that are observed in the real world.

The word attack in the name of the framework

is actually an acronym,

and it stands for Adversarial Tactics,

Techniques and Common Knowledge.

If you would like to explore the attack framework

you can visit attack.mitre.org.

This is a free and open-source website

that contains a matrix model

that's gonna give you different columns

for each type or category of attack that could occur.

Basically, it's gonna map out each threat

actor's methodologies that's gonna be used

during different types of attacks.

For example, there is columns for defensive evasion,

credentialed access, discovery,

lateral movement, and execution.

Underneath each of these categories is a tactic

or technique that could be used by an attacker

to accomplish that particular goal.

When you visit attack.mir.org

you're gonna see the attack navigator

where you're gonna select different tactics or techniques,

and they'll be highlighted with different colors.

Here you can see one example

for APT 28 that's already been mapped out by the MITRE team.

APT 28 is an advanced persistent threat

that has been identified as being

a Russian Cyber Espionage Group, likely associated with

the Russian Military Intelligence Agency known as the GRU.

You'll also hear this APT called Fancy Bear.

Using the Attack Navigator, you can quickly see that APT 28

or Fancy Bear uses 10 common reconnaissance techniques

including vulnerability scanning, credential harvesting

and phishing for information.

They're also known for using spearfishing with attachments

and links and exploiting public facing web applications.

This attack matrix is a great way to visualize

the different types of techniques

that are used by a particular adversary.

And it shows all the different capabilities

and capacities that they're gonna use in their attacks.

By learning what an adversary does

and mimicking your penetration test to those techniques,

you can provide exceptional levels of training

to cyber defense personnel

at your target organization during your engagements.

Now, another use case for this tool

is on the defensive side,

if you're responding to an adversary response.

By going through and mapping out the attack

using the attack matrix,

and then comparing it to determine which adversary

is likely exploiting your network,

you can identify who may be causing you all that pain.

Another variation of the MITRE ATT&CK framework is

called the Attack for Industrial Control Systems or ICS.

This MITRE ATT&CK for ICS framework describes

the set of tactics and techniques

specific to industrial control systems

and list the elements described

in the attack for ICS knowledge base as another matrix.

It works just like the regular attack matrix

except this one is focused on techniques.

They're used only for ICS devices.