Analisa dan Test Penetrasi

Keamanan Teknologi Informasi

2024
2022
© 2024 INIXINDO
Course Outline
• Security Analysis and • Internal Network Penetration
Penetration Testing Testing Methodology
Methodology • Perimeter Network Penetration
• TCP IP Packet Analysis Testing Methodology
• Pre-Penetration Testing Steps • Web Application Penetration
Testing Methodology
• Information Gathering • Database Penetration Testing
Methodology Methodology
• Vulnerability Analysis • Wireless Network Penetration
• External Penetration Testing Testing Methodology
Methodology • Report Writing and Post Test
Actions

2024
2022
Adaptive Security Strategy

2024
2022
Adaptive Security Strategy (Cont’d)

2024
2022
Security Analysis and Penetration
Testing Methodology
Chapter 1.

2024
2022
© 2024 INIXINDO
Security Analysis and
Penetration Testing
Methodology
Welcome! This presentation outlines the methodology for security
analysis and penetration testing, crucial for identifying and mitigating
vulnerabilities in your systems.

2024
2022
Security Concerns and Challenges
Data Breaches Cybercrime Compliance Requirements
Unauthorized access to sensitive Ransomware, phishing attacks, and Meeting industry-specific
information can lead to financial malware pose significant threats to regulations and standards is crucial
losses, reputational damage, and organizations of all sizes. for maintaining trust and avoiding
legal consequences. penalties.

2024
2022
Information Security
Components
People Processes
Security awareness training Clear policies and procedures
and best practices for for access control, incident
employees are essential for response, and data
minimizing human error. management are crucial.

Technology
Firewalls, intrusion detection systems, and encryption
technologies are crucial for protecting your network.

2024
2022
Defense-in-Depth Strategy
Physical Security
1 Access control, surveillance, and environmental protection.

Network Security
2
Firewalls, intrusion detection systems, and network segmentation.

Endpoint Security
3
Antivirus software, endpoint detection and response, and user access control.

Application Security
4
Vulnerability scanning, secure coding practices, and penetration testing.

Data Security
5
Encryption, data loss prevention, and access control.

2024
2022
What is Penetration Testing?

Penetration testing simulates real-world attack scenarios to

identify exploitable vulnerabilities in your systems.

Help in determining feasibility of a set of attack vectors and

determine potential business impact of a successful attack.

Provide a comprehensive approach for preparation steps that

can be taken to prevent upcoming exploitation.

Evaluate the efficiency of network security devices such as

firewalls, routers, and web servers.

2024
2022
Penetration Testing vs Vulnerability Assessment
Penetration Testing Vulnerability Assessment
Active, hands-on testing to exploit vulnerabilities. Passive scanning to identify potential weaknesses.

Penetration testing goes one step ahead of

vulnerability testing: vulnerability tests verify
known vulnerabilities; penetration tests
adopt the concept of "defense in depth“.

Penetration testing goes beyond testing

for known vulnerabilities and adopts
innovative means of demonstrating
where security fails in an organization.

2024
2022
Scope and Types of Pentest

Black Box White Box

No prior knowledge of the target Full access to the target
system. system's code and
documentation.

Gray Box External/Internal

Partial knowledge of the target Testing from outside or inside
system, such as access to user the organization's network.
accounts.

2024
2022
Penetration Testing Phases

Planning Information Gathering Vulnerability Scanning

Define the scope, goals, and Gather intelligence about the Identify potential weaknesses.
methodology. target system.

Exploitation Reporting Remediation

Attempt to exploit vulnerabilities. Document findings and Implement security fixes and
recommendations. improvements.

2024
2022
Penetration Testing Methodology
Reconnaissance
Gather information about the target system.

Scanning
Identify open ports and services.

Exploitation
Attempt to exploit vulnerabilities.

Reporting
Document findings and recommendations.

2024
2022
TCP IP Packet Analysis
Chapter 2.

2024
2022
© 2024 INIXINDO
TCP/IP Packet Analysis
Unraveling the intricate world of network communication.

2024
2022
Overview of the TCP/IP Model
Application Layer Transport Layer Internet Layer Network Access
Layer
Handles communication Provides reliable data Responsible for
between applications, like transfer services, addressing and routing Handles the physical
web browsers and email ensuring data arrives packets across networks. transmission of data over
clients. correctly and in order. the network.

2024
2022
TCP/IP Model vs OSI Model
TCP/IP
Simpler model with fewer layers, focusing on practical
implementation.

OSI
More complex model with seven layers, providing a
theoretical framework for network communication.

2024
2022
Transfer Control Protocol
(TCP)
1 Connection-oriented 2 Flow Control
Establishes a connection Manages the rate of data
before data transfer, transmission to prevent
ensuring reliable data network congestion.
delivery.

3 Error Checking
Detects and corrects errors during transmission, ensuring data
integrity.

2024
2022
[Link]
User Datagram Protocol (UDP)
Connectionless No Flow Control Minimal Error Checking
Data is sent without establishing Data is transmitted without Limited error detection, making
a connection, offering faster but managing the rate, potentially it suitable for applications where
less reliable delivery. leading to network congestion. reliability is less critical.

2024
2022
Domain Name System (DNS)

Translation Service Hierarchical Structure

Translates human-readable Organizes domain names into a
domain names (e.g., hierarchy, facilitating efficient
[Link]) into numeric IP name resolution.
addresses.

Caching
Stores recently resolved domain
names, speeding up future
lookups.

2024
2022
[Link]
Dynamic Host Configuration
Protocol (DHCP)
1 Automatic Configuration
Assigns IP addresses, subnet masks, and other network
settings automatically.

2 Centralized Management
Manages IP address allocation and reduces manual
configuration effort.

3 IP Address Leasing
Leases IP addresses to clients, allowing efficient reuse
when devices are not active.

2024
2022
Best Practices for TCP/IP Packet Analysis

1 Understand Network Architecture

2 Use the Right Tools

3 Focus on Key Metrics

4 Analyze Packet Contents

5 Document Findings

2024
2022
Pre-penetration Testing Steps
Chapter 3.

2024
2022
© 2024 INIXINDO
Pre-Penetration Testing
Steps: A Comprehensive
Guide

2024
2022
Defining Scope and Goals
What Why How
Define the specific systems, Determine the objectives of the Establish the testing methodologies
networks, and applications to be penetration test, including and techniques to be employed,
tested. vulnerabilities, compliance, and risk such as black box, grey box, or white
assessments. box testing.

2024
2022
List Client Purpose and
Requirements
Business Needs Technical
Understand the client's
Specifications
business objectives and Gather detailed information
how the penetration test about the target systems,
aligns with them. including software versions,
configurations, and network
infrastructure.

Compliance Standards
Identify any relevant compliance standards that the penetration
test should adhere to, such as PCI DSS or HIPAA.

2024
2022
Obtained Detailed Proposal
Scope of Work Testing
Clearly define the specific
Methodologies
systems, applications, and Describe the techniques and
network components to be tools that will be used to
tested. conduct the penetration test.

Deliverables Timeline and Budget

Outline the expected Specify the timeframe for the
deliverables, including penetration test and the
reports, findings, and associated cost.
recommendations.

2024
2022
[Link]
Checklist of Testing
Requirements

Vulnerability Scanning Network Penetration Testing

Identify potential vulnerabilities in Assess the security of network
systems and applications. infrastructure, including firewalls
and intrusion detection systems.

Web Application Database Security Assessment

Security Assessment Examine the security of
Evaluate the security of web databases and data storage
applications against common systems.
vulnerabilities.
2024
2022
[Link]
Penetration Testing Draft
Contracts
1 Terms and Conditions
Specify the scope, deliverables, timeframe, and
payment terms of the penetration test.

2 Liability and Indemnification

Outline the responsibilities and limitations of both
parties in case of any damage or loss resulting from the
test.

3 Confidentiality and Data Security

Address the handling and protection of sensitive
information obtained during the penetration test.

2024
2022
[Link]
Non-Disclosure Agreements
(NDAs)
Protect Sensitive Information
Prevent the disclosure of confidential information during
the penetration test.

Safeguard Business Secrets

Ensure that proprietary information, such as trade
secrets, is not compromised.

Maintain Client Privacy

Protect the client's reputation and prevent unauthorized
access to customer data.

2024
2022
[Link]
Rules of Engagements (RoE)
Scope and Objectives 1
Clearly define the scope of the penetration test,
the specific systems and applications to be
targeted, and the testing objectives. 2 Testing Methodologies
Outline the permitted testing techniques, tools,
and vulnerabilities to be exploited.
Communication and Reporting 3
Establish clear communication channels and
reporting procedures between the penetration
4 Escalation Procedures
tester and the client.
Define procedures for handling critical issues,
security breaches, or unexpected outcomes.
Acceptable Risk Levels 5
Establish acceptable risk levels and define
boundaries for testing activities to ensure
responsible and ethical conduct.

2024
2022
Statement of Works (SoW)
Detailed Tasks
1
Specify the specific tasks to be performed during the penetration test.

Timeline and Deadlines

2
Outline the schedule for each task and the expected completion dates.

Deliverables and Reporting

3
Define the deliverables, including reports, findings, and recommendations.

Acceptance Criteria
4 Establish clear criteria for acceptance of the completed
work and deliverables.

2024
2022
Information Gathering
Methodology
Chapter 4.

2024
2022
© 2024 INIXINDO
Information Gathering
Methodology
This presentation will guide you through the intricacies of information
gathering, a crucial process in cybersecurity and penetration testing.

2024
2022
[Link]
Defining Information Gathering
The Foundation of Cybersecurity Building a Comprehensive Picture
Information gathering is the initial phase of cybersecurity This data is vital for understanding a target's
assessments. It's a systematic approach to collecting vulnerabilities, identifying potential attack vectors, and
data about an organization's systems and networks. developing effective security strategies.

2024
2022
Importance of Information
Gathering
1 Vulnerability 2 Attack Vector
Assessment Identification
By gathering information, You can pinpoint how
you can identify attackers might gain
weaknesses that hackers access to your systems
could exploit. and data.

3 Risk Mitigation
Understanding threats allows you to prioritize security efforts
and proactively reduce risk.

2024
2022
[Link]
Types of Information Gathering
Footprinting Scanning
Initial reconnaissance to gather basic information Actively probing a target's network to identify open
about a target. ports and services.

Enumeration Vulnerability Assessment

Gaining a deeper understanding of the target's Identifying specific weaknesses in the target's systems
systems, users, and resources. and applications.

2024
2022
Footprinting

Domain Information Website Analysis

Gathering information about the Analyzing the target's website for
target's domain name, website, vulnerabilities, technologies
and associated DNS records. used, and potential entry points.

Social Media Analysis

Exploring social media profiles,
employee information, and any
publicly available data.

2024
2022
[Link]
Scanning
Port Scanning Service Identification
Identifying open ports on the target's network, revealing Determining which services are running on the target's
services that could be exploited. network, and their versions.

1 2 3

Vulnerability Scanning
Checking for known vulnerabilities in the target's
systems and applications.
2024
2022
Enumeration

User Enumeration Directory Enumeration Service Enumeration

Identifying users and accounts on Discovering directories and files Gaining detailed information about
the target's network, potentially available on the target's web server, the services running on the target's
gaining access to their credentials. revealing sensitive information. network, including their versions
and configuration settings.

2024
2022
Techniques of Information Gathering
Passive Information Gathering 1
Gathering information from publicly available
sources without interacting with the target.
2 Active Information Gathering
Interacting with the target's network to obtain
information, potentially raising alarms.
OSINT 3
Utilizing open-source intelligence techniques to
gather information from publicly available
databases and platforms. 4 Social Engineering
Manipulating people to obtain information
through social interactions.

2024
2022
Tools for Information Gathering
Nmap
1
A powerful network scanner for identifying open ports, services, and vulnerabilities.

Shodan
2
A search engine for connected devices, allowing you to find specific devices and services.

Maltego
3 A data visualization tool that helps you analyze and link information
gathered from various sources.

Burp Suite
4 A web application security tool with features for
information gathering, vulnerability scanning, and
exploitation.
2024
2022
Best Practices and Ethics in
Information Gathering

1 2
Obtain Permission Respect Privacy
Always obtain explicit permission Only gather information that is
from the target before conducting publicly available or necessary for
any information gathering your legitimate purposes.
activities.

3
Minimize Impact
Avoid performing actions that
could disrupt or harm the target's
systems or network.
2024
2022
[Link]
Vulnerability Analysis
Chapter 5.

2024
2022
© 2024 INIXINDO
Vulnerability Analysis:
Uncovering Cybersecurity
Weaknesses
This presentation will guide you through the crucial process of
vulnerability analysis, outlining its purpose, methodology, and
benefits for your organization's cybersecurity.

2024
2022
[Link]
Understanding the Purpose of Vulnerability
Assessments
Identify Weaknesses Reduce Risk Compliance
Vulnerability assessments uncover By identifying and mitigating Meeting regulatory requirements
security weaknesses that could be vulnerabilities, you proactively and industry standards often
exploited by malicious actors. decrease the likelihood of requires demonstrating vulnerability
successful cyberattacks. management practices.

2024
2022
The Vulnerability Assessment Process
Planning & Scoping 1
Define the assessment's scope, including assets,
systems, and potential threat vectors.
2 Data Collection
Gather information about the environment,
including system configurations, software
Scanning & Testing 3 versions, and network topology.
Employ automated tools and manual techniques
to identify vulnerabilities in systems and
applications. 4 Analysis & Reporting
Analyze the results of the assessment, categorize
vulnerabilities, and generate detailed reports with
Remediation & Validation 5 recommendations.
Implement corrective actions to mitigate
identified vulnerabilities, then validate the
effectiveness of the fixes.

2024
2022
Identifying Vulnerabilities:
Scanning and Testing

Automated Scanning Penetration Testing

Utilize tools to identify Simulate real-world attacks to
vulnerabilities in a systematic and assess the effectiveness of
efficient manner. security controls and identify
exploitable vulnerabilities.

Manual Audits
Conduct manual assessments to
review security configurations,
access controls, and other
security-related aspects.
2024
2022
Classifying and Prioritizing Vulnerabilities
Severity Risk
Categorize vulnerabilities based on their potential Assess the likelihood of a vulnerability being exploited
impact, such as low, medium, high, or critical. and the potential damage it could cause.

Exploitability Impact
Consider the ease with which a vulnerability can be Evaluate the potential impact of a successful attack,
exploited, including the availability of tools and such as data breach, system downtime, or financial
techniques. loss.
2024
2022
Assessing the Risks of Identified Vulnerabilities

Threat Analysis Vulnerability Evaluation Impact Assessment

Identify potential threat actors, their Assess the severity and Determine the potential
motivations, and the types of exploitability of identified consequences of a successful
attacks they might employ. vulnerabilities in the context of attack, considering financial,
known threats. operational, and reputational
impacts.

2024
2022
Remediation Strategies: Patching and Mitigation
Patching
1
Install security updates and patches provided by software vendors to address known vulnerabilities.

Configuration Hardening
2 Strengthen system configurations by disabling unnecessary services, implementing
strong access controls, and enforcing security policies.

Mitigation Controls
3 Implement security controls, such as firewalls, intrusion detection
systems, and antivirus software, to prevent or detect attacks.

Workarounds
4 Implement temporary workarounds to reduce the risk of
vulnerabilities until permanent solutions are available.

2024
2022
Implementing Vulnerability
Management Programs

1 2
Asset Inventory Continuous Monitoring
Maintain a comprehensive Regularly scan systems and
inventory of all IT assets, applications for vulnerabilities,
including systems, applications, using automated tools and
and network devices. manual checks.

3 4
Risk Assessment Remediation & Reporting
Prioritize vulnerabilities based on Implement remediation
their severity and potential impact strategies, track the
on the organization. effectiveness of fixes, and
report vulnerabilities to 2024
2022
[Link]

stakeholders.
Conclusion: Embracing
Vulnerability Analysis for
Stronger Cybersecurity
By incorporating vulnerability analysis into your security strategy, you
can proactively identify and mitigate weaknesses, enhancing your
organization's resilience to cyberattacks. Remember, continuous
monitoring, timely remediation, and ongoing improvement are vital for
maintaining a secure and robust cybersecurity posture.

2024
2022
External Penetration Testing
Methodology
Chapter 6.

2024
2022
© 2024 INIXINDO
External Penetration Testing
Methodology
This presentation outlines the systematic process of
conducting external penetration testing, a critical security
measure for organizations.

2024
2022
[Link]
Objectives and Scope
Objectives Scope
The primary goal is to identify vulnerabilities and The scope defines the specific network assets, systems,
potential attack vectors that could compromise an and applications targeted for testing, including external
organization's security posture. facing web applications, network infrastructure, and
critical business services.

2024
2022
External Penetration Testing

2024
2022
Information Gathering and
Reconnaissance
1 Passive 2 Active
Gathering publicly Scanning ports, identifying
available information such running services, and
as domain registration performing
details, website content, reconnaissance scans to
and social media profiles. gather information about
the target network.

3 Open Source Intelligence

Leveraging open-source intelligence platforms to gather
information about the target organization, its employees, and
its business activities.

2024
2022
Create Topological Map of Network

Network Discovery
1 Scanning the network to identify all connected devices and their roles.

Service Identification
2 Mapping the running services and their associated ports on each
identified device.

Data Flow Analysis

3 Determining the flow of data between devices and
identifying potential points of weakness.

2024
2022
Vulnerability Identification
and Analysis
Vulnerability Manual Analysis
Scanning Performing in-depth analysis
Using automated tools to
of identified vulnerabilities to
scan for known
assess their severity,
vulnerabilities in operating
exploitability, and potential
systems, applications, and
impact.
network devices.

Risk Assessment
Prioritizing vulnerabilities based on their severity, likelihood of
exploitation, and potential impact on the organization's security
posture.

2024
2022
Exploitation and Exploitation
Attempts
1 Exploitation
Attempting to exploit identified vulnerabilities using
known attack techniques and tools.

2 Proof of Concept
Developing and testing proof-of-concept exploits to
demonstrate the vulnerability's exploitability.

3 Impact Assessment
Evaluating the impact of successful exploits, such as
data exfiltration, system compromise, or denial of
service.
2024
2022
[Link]
Lateral Movement and
Privilege Escalation
Lateral Movement
Moving from one compromised system to another within
the target network, aiming to gain access to more
valuable systems or data.

Privilege Escalation
Attempting to escalate privileges from a low-level user
account to a higher-level account with administrative
rights.

System Control
Gaining control over critical systems, such as servers,
databases, or applications, enabling the attacker to
perform malicious actions.

2024
2022
Data Exfiltration and
Reporting

1 2
Data Exfiltration Reporting
Attempting to steal sensitive Generating a comprehensive
data from the compromised report outlining the findings,
systems and exfiltrate it to a including identified
remote location controlled by the vulnerabilities, successful
attacker. exploits, and recommendations
for remediation.

2024
2022
Remediation Recommendations

Patching Firewall Configuration

Implementing security patches to Strengthening firewall rules to
fix known vulnerabilities in block unauthorized access and
software and operating systems. prevent malicious traffic from
entering the network.

Security Awareness Training

Educating users about common
cyber threats and best practices
to prevent phishing attacks,
malware infections, and other
security incidents.
2024
2022
[Link]
Internal Network Penetration
Testing Methodology
Chapter 7.

2024
2022
© 2024 INIXINDO
Internal Network Penetration Testing
Methodology

2024
2022
Understanding the Scope and Objectives
Business Impact Technical Scope
Understanding the business's objectives, critical systems, Defining the network segments, devices, and applications
and potential risks are essential for effective penetration within the testing scope is crucial. This ensures the
testing. This includes identifying sensitive data and penetration test focuses on the most relevant targets.
business processes that need to be protected.

2024
2022
Reconnaissance and Information
Gathering
Open Source Passive Scanning
Intelligence (OSINT)
Collecting information about
Gathering information from
the target network without
publicly available sources like
actively interacting with it.
websites, social media, and
This includes identifying open
industry reports to gain insights
ports, services, and network
into the target organization's
devices.
structure, technology, and
vulnerabilities.

Footprinting
Collecting information about the target's network infrastructure,
including IP addresses, domains, and DNS records. This provides a
detailed picture of the network topology.

2024
2022
Network Mapping and Asset
Identification

Network Topology Asset Inventory

Creating a detailed map of the Identifying all devices, systems,
target network, including all and applications within the
devices, connections, and network. This includes
protocols. This provides a categorizing assets based on
comprehensive understanding of their importance and sensitivity.
the network's layout and
structure.

2024
2022
Vulnerability Assessment and
Analysis
1 Vulnerability Scanning
Using automated tools to identify known vulnerabilities in
software, operating systems, and network devices. This
helps prioritize the most critical vulnerabilities for further
investigation.

2 Manual Assessment
Performing manual analysis to identify vulnerabilities not
detected by automated tools. This involves reviewing
configuration files, code, and system logs.

3 Vulnerability Prioritization
Ranking vulnerabilities based on their severity,
exploitability, and impact on the organization. This helps
focus remediation efforts on the most critical risks.

2024
2022
Exploitation and Lateral Movement

Exploit Development Payload Delivery Lateral Movement

Developing or acquiring exploits that Delivering the exploit payload to the Moving laterally through the network
leverage identified vulnerabilities. target system. This can be done to access other systems. This
This involves crafting code or tools through various methods, such as involves using compromised
to gain unauthorized access to email attachments, malicious systems as stepping stones to gain
systems. websites, or network connections. access to more valuable targets.

2024
2022
Privilege Escalation and Post-Exploitation

Gaining Privileges
Attempting to escalate privileges from a low-level user to a higher-level
1
administrator account. This allows access to more sensitive systems and
data.

Persistence
2 Establishing a persistent presence on the compromised system.
This allows the attacker to maintain access even after the initial
attack.

Data Exfiltration
Exfiltrating sensitive data from the target system. This
3
can be done through various channels, such as email,
FTP, or cloud storage.

2024
2022
Perform Network Sniffing

1 2
Packet Capture Data Analysis
Intercepting and capturing network packets, which contain Analyzing the captured packets to identify sensitive
information about communication between devices. information, such as passwords, usernames, and
confidential data.

2024
2022
Perform Session Hijacking on Web Traffic

Intercepting Sessions Session Hijacking

Capturing and analyzing network traffic to identify and Taking over an existing web session by capturing the
intercept ongoing web sessions. session cookie or other authentication tokens.

2024
2022
Attempt to Send Malware to the Target Host
Malware Development
1
Creating or acquiring malicious software designed to compromise the target system.

Malware Delivery
2 Delivering the malware to the target host through various methods, such as
email attachments, malicious websites, or network connections.

Malware Execution
3 Tricking the target user into executing the malware,
allowing it to install itself on the system.

2024
2022
Perimeter Network Penetration
Testing Methodology
Chapter 8.

2024
2022
© 2024 INIXINDO
Perimeter Network
Penetration Testing
Methodology
This presentation outlines a comprehensive methodology for
performing perimeter network penetration testing. It covers
the key steps involved, from defining the scope and objectives
to reporting findings and recommending remediation.

2024
2022
What is a Perimeter Network?
The perimeter network is the outermost layer of an The perimeter network is typically protected by firewalls,
organization's network. It acts as a boundary between the intrusion detection systems (IDS), and other security
organization's internal network and the external world. It measures. It's a critical security layer that helps prevent
includes all the devices and systems that connect to the unauthorized access to the organization's internal
internet or other external networks. network and data. It's essential for safeguarding sensitive
information and maintaining business operations.

2024
2022
What is Perimeter Network
Penetration Testing?
Perimeter network penetration testing is a method of simulating real-
world attacks against an organization's perimeter network to identify
security vulnerabilities. Penetration testers use a variety of
techniques and tools to attempt to gain unauthorized access to the
network and its systems. They then report their findings to the
organization, providing recommendations for remediation. It's a
proactive security measure to identify and address weaknesses
before they can be exploited by malicious actors. This helps
organizations strengthen their security posture and protect
themselves from cyber threats.

2024
2022
[Link]
Scope and Objectives
Identify Vulnerabilities Assess Risk
Find exploitable Determine the likelihood
weaknesses in the and impact of potential
perimeter network, such as attacks, helping prioritize
misconfigured firewalls, remediation efforts.
outdated software, or
insecure protocols.
Validate Security Improve Security
Controls Posture
Verify the effectiveness of Provide recommendations
security measures, for improving the overall
including firewalls, intrusion security of the perimeter
detection systems, and network, reducing the risk
other security controls. of successful attacks.

2024
2022
Firewall and IDS Tools
Firewalls Intrusion Detection Systems (IDS)
Firewalls act as gatekeepers, filtering network traffic IDSs monitor network traffic for suspicious patterns and
based on predefined rules. Common types include alert administrators of potential attacks. They can be
stateful firewalls, next-generation firewalls (NGFWs), and deployed as network-based or host-based systems.
application firewalls.

2024
2022
Testing Firewall and IDS
Port Scanning
Identify open ports and services that could be exploited
by attackers.

Vulnerability Scanning
Check for known vulnerabilities in firewall and IDS
software, as well as other network devices and
applications.

Packet Analysis
Examine network traffic to identify potential anomalies
and patterns of malicious activity.

2024
2022
[Link]
Trying to Bypass Firewall and IDS

Exploit Known Vulnerabilities Evade Detection

Attempt to use known vulnerabilities to bypass firewall Use techniques such as obfuscation, encryption, or
or IDS rules, such as buffer overflows or cross-site tunneling to avoid detection by the IDS.
scripting (XSS).

Utilize Uncommon Ports Bypass Firewall Rules

Attempt to connect through ports not typically Find loopholes in firewall rules that can be exploited to
monitored by firewalls or IDSs, leveraging obscure gain unauthorized access.
protocols.

2024
2022
Exploitation and Privilege Escalation
Exploit Security Flaws
1
Gain initial access to the network using vulnerabilities in software or system configurations.

Elevate Privileges
2
Once inside, attempt to gain administrator or root privileges to control the system.

Install Backdoors
3 Establish persistent access to the network by planting
backdoors or malware to maintain control.

2024
2022
Lateral Movement and Internal
Network Assessment
1 Mapping the Network
Use reconnaissance techniques to map the network
infrastructure and identify potential targets.

2 Gaining Footholds
Exploit vulnerabilities in internal systems to gain access
to sensitive data or critical infrastructure.

3 Internal Penetration Testing

Test the security of internal systems and applications,
simulating real-world attacks.

2024
2022
[Link]
Reporting and Remediation Recommendations

1 2 3
Findings Summary Remediation Vulnerability Prioritization
Recommendations
Provide a detailed summary of the Suggest specific actions to address Prioritize remediation efforts based on
vulnerabilities discovered during the the identified vulnerabilities, including the severity of the vulnerabilities and
penetration test, including severity patching software, configuring the likelihood of exploitation.
levels and impact. security settings, or implementing new
security controls.
2024
2022
Web Application Penetration
Testing Methodology
Chapter 9.

2024
2022
© 2024 INIXINDO
Web Application Penetration
Testing Methodology
A detailed guide to the methodology used for penetration
testing web applications.

2024
2022
[Link]
Importance of Web Application Security
Web applications are increasingly critical to The consequences of a security breach can be
businesses and individuals. They are used for severe. Data breaches can lead to financial losses,
everything from online banking to shopping to reputational damage, and legal action.
social media.

2024
2022
Perform Website
Footprinting
1 Gather Information 2 Identify Target
The initial step involves This includes identifying the
gathering as much target's domain name, IP
information as possible address, and other publicly
about the target website. available information.

3 Understand Structure
A detailed analysis of the website's structure, including its
technologies, framework, and plugins.

2024
2022
Analyze the HTML Source
Code
Inspect Code Look for Errors
The source code of the This includes looking for
website should be carefully common security issues
analyzed for any potential such as cross-site scripting
vulnerabilities. (XSS) and SQL injection.

Understanding Structure
Understand the structure of the web application and its components.

2024
2022
Perform Web Vulnerability
Scanning

Automated Tools Vulnerability Database

Use specialized tools to scan the These tools compare the website
website for known to a database of known
vulnerabilities. vulnerabilities.

Identify and Prioritize

The scanner will identify
potential vulnerabilities, which
are then prioritized based on
their severity.
2024
2022
Perform SQL Injection Attack
1 Understanding SQL
SQL injection attacks exploit vulnerabilities in the way
that a web application interacts with a database.

2 Injecting Malicious Code

An attacker attempts to inject malicious SQL code into
the web application's input fields.

3 Gaining Access
This can allow the attacker to gain access to sensitive
information stored in the database.

2024
2022
Cross Site Scripting (XSS)
Injecting JavaScript
XSS attacks involve injecting malicious JavaScript code
into the website's code.

User Interaction
The injected code is executed when a user interacts
with the website, such as clicking on a link or
submitting a form.

Exploiting Weakness
The attacker can then exploit this to steal user data,
take control of the user's account, or redirect the user to
a malicious website.

2024
2022
Directory Traversal Attack
Targeting File Structure 1
Directory traversal attacks attempt to access
files and directories that are not intended to be
publicly accessible. 2 Exploiting Vulnerability
This is achieved by exploiting vulnerabilities in
the way that the web application handles file
Gaining Access 3 paths.
By manipulating the file path, the attacker can
gain access to sensitive information or even
execute malicious code.

2024
2022
Test Password Quality
Password Complexity
1
Assess the password requirements and enforce strong password policies.

Password Strength
2
Test the strength of passwords by using password cracking tools.

Brute Force Attacks

3 Simulate brute force attacks to see how vulnerable
passwords are.

2024
2022
Reporting and Remediation Recommendations

1 2
Detailed Findings Remediation Steps
A comprehensive report detailing the vulnerabilities found Provide specific recommendations on how to fix
during the penetration test. the vulnerabilities.

3 4
Risk Assessment Prioritization
Assess the risk associated with each vulnerability. Prioritize vulnerabilities based on their severity and impact.

2024
2022
Database Penetration Testing
Methodology
Chapter 10.

2024
2022
© 2024 INIXINDO
Database Penetration
Testing Methodology
This presentation will outline the key steps and
considerations involved in conducting effective database
penetration testing.

2024
2022
[Link]
Reconnaissance and Information Gathering
Target Identification Information Gathering
Identifying the specific database systems to be tested, Collecting information about the target databases, such
including their purpose and criticality. as their versions, configurations, and vulnerabilities.

2024
2022
Perform Database Port
Scanning

Port Scanning Vulnerability Scanning

Identifying open ports on the Scanning the database for
database server to determine known vulnerabilities and
which services are running. misconfigurations.

2024
2022
[Link]
Sniff Database Traffic
Packet Capture
Intercepting and analyzing network traffic between
clients and the database server.

Traffic Analysis
Examining the intercepted traffic to identify potential
vulnerabilities and security flaws.

2024
2022
Testing Default
Authentication on Databases

1 2
Default Credentials Brute-Force Attacks
Attempting to log in using Using automated tools to try
common default credentials. different combinations of
usernames and passwords.

2024
2022
[Link]
Database Penetration
Testing Tools
SQL Injection Tools Database
Tools for identifying and
Enumeration Tools
exploiting SQL injection Tools for discovering and
vulnerabilities. analyzing database schemas
and objects.

Database Fuzzing Tools

Tools for automatically testing database applications for
vulnerabilities.

2024
2022
Remediation and Mitigation Strategies
Patching
1
Applying security patches to address known vulnerabilities.

Configuration Hardening
2
Securing the database by implementing appropriate security settings.

Access Control
3 Restricting access to the database based on user roles
and permissions.

2024
2022
Recommendations for
Securing Database
Implement
1 Strong 2 Regular Security
Authentication Audits
Utilize multi-factor Conduct periodic security
authentication for audits to identify and
accessing the database. address vulnerabilities.

3 Data Encryption
Encrypt sensitive data both at rest and in transit.

2024
2022
Conclusion and Key
Takeaways
Database penetration testing is crucial for identifying and
mitigating security vulnerabilities, ensuring the confidentiality,
integrity, and availability of sensitive data.

2024
2022
[Link]
Wireless Network Penetration
Testing Methodology
Chapter 11.

2024
2022
© 2024 INIXINDO
Wireless Network
Penetration Testing
Methodology
This presentation outlines a comprehensive approach to
penetration testing wireless networks, focusing on the
essential steps and key considerations for identifying
vulnerabilities and improving security.

2024
2022
Importance of Wireless Security Assessment
Wireless networks are increasingly vulnerable to attacks. Regular penetration testing is crucial for identifying and
Attackers can exploit weaknesses to steal sensitive data, mitigating vulnerabilities before they are exploited by
disrupt operations, or launch further attacks. malicious actors. This helps organizations ensure the
confidentiality, integrity, and availability of their data and
resources.

2024
2022
Wireless Security Threats
Data Breaches Man-in-the-
Middle Attacks
Unauthorized access to
Interception of communication
confidential information
between devices on the
stored on devices connected
network, allowing attackers to
to the wireless network.
eavesdrop or manipulate data.

Denial of Service Malware Infection

Attacks Spread of malicious
Disruption of network software that can steal data,
services by flooding the compromise devices, or
network with traffic, making launch further attacks.
it inaccessible to authorized
users.

2024
2022
Reconnaissance: Gathering
Information on the Target
Network
Network Mapping SSID Enumeration
Scanning for available
Identifying wireless access
wireless networks and
points, their SSIDs, and their
identifying their SSIDs,
physical locations.
channels, and encryption
protocols.

Vulnerability Research
Gathering information about known vulnerabilities in the target
network's hardware, software, and configuration.

2024
2022
[Link]
Scanning: Identifying
Wireless Access Points and
Client Devices

Wireless Access Client Device

Point Discovery Identification
Utilizing tools to detect and map Identifying and enumerating
wireless access points within devices connected to the
range of the target network. wireless network, such as
laptops, smartphones, and IoT
devices.

2024
2022
[Link]
Perform Wireless Network
Sniffing
1 Capturing network traffic passing through the wireless
network, including data packets, authentication
attempts, and communication between devices.

2 Analyzing the captured traffic to identify sensitive

information, vulnerabilities, and patterns of activity that
could indicate security weaknesses.

2024
2022
Exploitation: Gaining Unauthorized Access to the
Wireless Network

Password Cracking Exploiting Known Vulnerabilities

Using tools to try different password combinations to Leveraging known vulnerabilities in the target network's
gain unauthorized access to the wireless network. hardware, software, or configuration to gain access.

2024
2022
Create a Rogue Access Point
Create a Fake Access Point
Setting up a fake access point that imitates a legitimate access point
1
to deceive users into connecting.

Capture Credentials
2 Intercepting authentication credentials, such as
usernames and passwords, as users connect to the
fake access point.

2024
2022
Perform a Denial of Service Attack
Flooding the Network
1 Sending a large volume of traffic to the target access point, overwhelming it and
causing it to become unresponsive.

Disrupting Service
2 Denying legitimate users access to the network by
consuming all available bandwidth and resources.

2024
2022
Reporting and Remediation:
Documenting Findings and
Recommendations

1 2
Vulnerability List Risk Assessment
Detailed description of each Evaluation of the potential impact
vulnerability identified during the and likelihood of exploitation for
penetration test. each vulnerability.

3
Remediation Recommendations
Specific steps to mitigate the
identified vulnerabilities and
improve network security.
2024
2022
[Link]
Report Writing and Post Test
Actions
Chapter 12.

2024
2022
© 2024 INIXINDO
Penetration Testing
Deliverables
This presentation will cover key aspects of penetration testing
deliverables and reporting.

2024
2022
Goal of the Penetration Testing Report
Communicate Findings Provide Actionable Insights Enhance Security Posture
Clearly and concisely communicate Present the findings in a way that Help the client improve their overall
the results of the penetration test to enables the client to take security posture by identifying
the client. appropriate action. vulnerabilities and recommending
remediation steps.

2024
2022
Types of Penetration Testing
Reports
Formal Report Technical Report
Comprehensive and detailed, Focuses on technical details,
suitable for legal and useful for security teams and
regulatory requirements. developers.

Summary Report
Provides a concise overview of the findings, suitable for
executives and stakeholders.

2024
2022
Characteristics of a Good Penetration Testing Report
1 Clarity 2 Conciseness
Written in plain language, avoiding technical jargon. Focus on the most important findings and
recommendations.

3 Accuracy 4 Objectivity
Report only verified findings and avoid speculation. Present findings in a neutral and unbiased manner.

2024
2022
Writing the Final Report

Introduction Methodology
Summarize the scope and Describe the tools and
objectives of the penetration techniques used during the test.
test.

Findings Recommendations
Present the identified Suggest specific steps for
vulnerabilities and their impact. mitigating the identified
vulnerabilities.

2024
2022
[Link]
Summary of Execution
1 Define scope and objectives of the test.

2 Conduct vulnerability scanning and reconnaissance.

3 Perform exploitation and penetration attempts.

4 Document findings and generate reports.

2024
2022
[Link]
Summary of Evaluation, Findings, and
Recommendations
Vulnerability Type Severity Impact Remediation Steps
SQL Injection High Data breach Implement input
validation and
parameterized queries.
Cross-Site Scripting (XSS) Medium Website defacement Encode user input and
implement a Content
Security Policy (CSP).

2024
2022
Develop Action Plan
Prioritize Findings
Focus on the most critical vulnerabilities.

Assign Responsibilities
Determine which team members will address each vulnerability.

Set Deadlines
Establish a timeline for implementing remediation steps.

Monitor Progress
Track the progress of remediation efforts.

2024
2022
Cleanup and Restoration
Remediate Vulnerabilities
1 Implement the recommended fixes.

Validate Fixes
2
Verify that the vulnerabilities have been successfully addressed.

Restore Systems
3
Ensure that systems are operational and secure.

2024
2022
Report Retention
Archive Reports
1
Store penetration testing reports in a secure location.

Define Retention Policy

2
Establish guidelines for how long reports will be retained.

Access Control
3
Limit access to reports based on authorization levels.

2024
2022