Planning & Meeting
Planning (or kick-off meeting) is a crucial stage of a grey box pentest. It ensures that the pentester understands the client's objectives, has the necessary information to conduct the tests, and respects the client's restrictions.
The kick-off meeting should cover the following:
Objectives of the pentest
The pentester must understand the client’s objectives for the pentest. These goals may include identifying vulnerabilities, complying with a security standard, or preparing for a cyberattack. The pentester should ask the client questions to clarify the pentest objectives and ensure that the client understands them.
Target information
The pentester must receive information about the target, such as network topology, running systems and applications, and sensitive data. This information is essential for the pentester to conduct effective testing. The client must provide the pentester with all information they can share.
Test plan
The pentester must present his test plan to the client. This plan must describe the techniques and tools that will be used for testing. The pentester must explain to the client why he chose these techniques and tools.
Pentest restrictions
The customer can impose restrictions on the pentest. These restrictions may include prohibiting testing of certain systems or applications or the use of certain techniques. The pentester should discuss these restrictions with the client and ensure they understand them.
Recognition & Information Collection
The recognition phase is a crucial step in a grey box pentest. It allows the pentester to understand the target and identify potential vulnerabilities.
By collecting information about the target, the auditor can improve the effectiveness of penetration testing and identify more potential vulnerabilities.
Objectives of the reconnaissance phase
The objectives of the reconnaissance phase are as follows:
- Understand the target: The pentester must understand the network topology, running systems and applications, sensitive data, security policies, etc.
- Identify critical assets: the pentester must identify the most important systems and applications for the target, as well as the most sensitive data.
- Identify potential vulnerabilities: The pentester should identify known vulnerabilities in systems and applications running on the target, as well as potential vulnerabilities that social engineering could exploit.
- Plan penetration tests: the information collected during the reconnaissance phase allows the pentester to plan penetration tests effectively, targeting the most vulnerable systems and applications.
Recognition techniques
The pentester can use a variety of techniques to gather information about the target, such as:
- Online Search: Searching for information about the target on the Internet, including news articles, social profiles and websites.
- Port Scan: Using a port scanner to identify open ports on target systems.
- Search for known vulnerabilities: Use of a database of known vulnerabilities to identify vulnerabilities present on the target.
- Social Engineering: Using social engineering techniques to obtain sensitive information from target users.
- Network Traffic Analysis: Scans the target's network traffic to identify running systems and applications, as well as open ports.
- Source code analysis: Analysis of the source code of the target's web applications to identify potential vulnerabilities.
- Audit Log Analysis: Analysis of target audit logs to identify suspicious activities.
Exploitation
The exploitation phase of a grey box pentest is the phase during which the auditor attempts to exploit the vulnerabilities that he identified during the reconnaissance phase.
This phase is the most important of the penetration test, because it helps determine whether the vulnerabilities are indeed exploitable and whether they can be used to compromise the target.
During the exploitation phase, the pentester uses a variety of techniques to exploit vulnerabilities, including:
- Exploits: Exploits are programs or scripts that exploit a specific vulnerability.
- Manual techniques: The auditor can also exploit a vulnerability manually, using technical knowledge and specific tools.
The pentester will work to compromise the target at various levels, from outside the network to inside the operating system. It will also strive to maximize the privileges obtained, in order to be able to access more resources and perform more important actions.
At the end of the exploitation phase, the pentester must be able to provide a detailed audit report, which lists the vulnerabilities exploited, the techniques used, the privileges obtained and the actions carried out.
Examples of exploitation techniques
- Exploitation of a configuration vulnerability: An auditor could exploit a configuration vulnerability of a firewall to gain access to an internal network, such as using a default password for the administrator account of the firewall.
- Exploitation of a software vulnerability: A pentester exploits a vulnerability in a web application to take control of a user account, such as SQL injection, which allows an attacker to execute code on the web server.
- Exploitation of a hardware vulnerability: An expert could exploit a vulnerability in a router to gain access to a wireless network. A common hardware vulnerability is a buffer vulnerability, which allows an attacker to execute code on the router.
Élaboration
The operating phase of a pentest grey box is a complex and delicate phase. The pentester must be creative and persistent in finding ways to exploit vulnerabilities. He must also be careful not to cause irreversible damage to the target.
The operating phase of a pentest grey box is a complex and delicate phase. The pentester must be creative and persistent in finding ways to exploit vulnerabilities. He must also be careful not to cause irreversible damage to the target.
- Have a good understanding of the vulnerabilities it is trying to exploit. He must know the technical details of the vulnerability, as well as known exploitation techniques.
- Use a variety of tools and techniques to exploit vulnerabilities. It should not rely solely on a single tool or technique.
- Be careful not to cause irreversible damage to the target. He must use tools and techniques that are non-destructive.
Ziwit Consultancy ServicesManual audits and Pentests on-site or remotely
