Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Pentest Proposal

Pentest Proposal

वेणु गोपाल

December 12, 2009
Tweet

More Decks by वेणु गोपाल

Other Decks in Technology

Transcript

  1. Penetrating a Network/System: An Offence & Defense Study Proposal Presentation

    for Secure Wired & Wireless Networks Project By Maneesh Venu Gopal
  2. Hacking?  Hacking is the unauthorized break in into computers/networks

    ...  Usually done by a bad guy (a.k.a Black Hat).  Its not magic. It has a methodology.  Many different Techniques (often change over time).  New vulnerabilities are found (therefore new attacks over time).
  3. Penetration Testing?  Testing the security of systems and architectures

    by a white hat from a hacker’s (a.k.a black hats) point of view.  A “simulated attack” with a predetermined goal.  Telling too many people may invalidate the test.
  4. Procedure  Same methodology  Same tools can be used

     Ping, Tracert, Whois, Nslookup, Dig, many more …  External/Internal  External view (hacker)  Internal view (disgruntled employee)
  5. Methodology  Reconnaissance  Enumeration  Fingerprinting  Identification of

    Vulnerabilities  Attack  Exploit the Vulnerabilities  Wipe off Traces  Get out
  6. Access Points to Your Network  Internet gateways  Modems

     Wireless networks  Physical entry  Social engineering
  7. Security Devices/Personnel  Firewalls  DMZ  Intrusion Detection Systems

     Intrusion Prevention Systems  Anti Malware Apps  Administrators (who are monitoring)  Routers  Subnets  Access Control Lists
  8. Limitations  Not an alternative to other IT security measures.

     It complements other tests.  Does not substitute other security measures.  Not a guarantee of security.  It’s only valid for the period tested.
  9. Lessons Learned / Benefits  Illustrates how a combination of

    factors can lead to a security breach.  Know the tools  COTS  Shareware/Freeware  Gets management’s attention.  Great educational opportunity for audit staff.
  10. References  Barnett, R. J. and Irwin, B. 2008. Towards

    a taxonomy of network scanning techniques. In Proceedings of the 2008 Annual Research Conference of the South African institute of Computer Scientists and information Technologists on IT Research in Developing Countries: Riding the Wave of Technology (Wilderness, South Africa, October 06 - 08, 2008). SAICSIT '08, vol. 338. ACM, New York, NY, 1-7.  Teo, L. 2000. Port Scans and Ping Sweeps Explained. Linux J. 2000, 80es (Nov. 2000), 2.