UNIT 2: Penetration Testing and Vulnerability Analysis - Short Notes

I. Foundations and Pre-engagement Planning

A. Legal and Ethical Considerations

• Definition: The framework of laws, regulations, contracts, and professional codes that govern the conduct of a penetration test.

• Core Principle: "No test without written authorization." This protects the tester from legal prosecution (e.g., under Computer Fraud and Abuse Act in US, IT Act in India).

• Key Elements:

  • Rules of Engagement (RoE): Formal document defining scope, timing, methods allowed/denied, and contact points.

  • Non-Disclosure Agreement (NDA): Legally binds tester to confidentiality of findings.

  • Ethical Hacking Code: Adherence to standards like (ISC)² Code of Ethics, EC-Council Code.

• Impact on Decision-Making: Organizations must weigh legal risks of testing (system downtime, data exposure) vs. security benefits. Proper authorization transforms an illegal act into a legitimate, contracted service.

  [!TIP] Exam Focus: Always link legal authorization to the tester's protection and the client's liability. Mention specific laws/acts relevant to the region.

B. Types and Use Cases of Penetration Testing

C. Pre-engagement Activities

1. Scoping & Objective Definition:

   • Define in-scope (IP ranges, apps, APIs) and out-of-scope assets.

   • Set clear, measurable objectives: "Find all critical vulnerabilities in the customer portal" vs. vague "Test our security."

   • Determine test type: Black-box (no internal knowledge), Gray-box (limited knowledge), White-box (full access).

2. Stakeholder Engagement:

   • Technical Teams (Dev, Ops, Net): For system details, change windows, and remediation coordination.

   • Management/Executives: For risk alignment, budget, and business impact communication.

   • Legal/Compliance: To ensure RoE/NDA meet regulatory requirements (GDPR, HIPAA, PCI-DSS).

   • Cryptographic Stakeholders: Specifically engage cryptographers, security architects, and application owners when testing systems relying on encryption (TLS, PKI, data-at-rest) to understand key management, algorithm choices, and implementation nuances.

3. Case Study: rgpvonline.com Objectives

   • Potential Scope: Web application (rgpvonline.com), associated APIs, subdomains, student/faculty portal.

   • Key Objectives: Assess for OWASP Top 10 vulnerabilities (especially SQLi, authentication flaws), evaluate session management, test for information disclosure, check for misconfigured cloud storage (if any).

   • Stakeholders: RGPV IT department, application developers, student data privacy officer (for PII handling).

II. Reconnaissance and Information Gathering

A. DNS Reconnaissance

• Purpose: To map the target's digital footprint, identify hosts, services, and network structure passively (without touching the target) and actively.

• Crucial Techniques:

  • Zone Transfer (AXFR): Attempt to dump entire DNS zone file (misconfiguration).

  • Enumeration: Using tools (dnsrecon, sublist3r, nslookup) to find subdomains, MX records, TXT records (often leak internal info, tech stack).

  • DNS History: Use services like SecurityTrails, VirusTotal to see historical DNS records.

• Why Crucial? It builds the attack surface map. A forgotten subdomain (dev.rgpvonline.com) might host a vulnerable test application, providing initial foothold. External presence analysis reveals what the world can see.

B. External Footprinting and Presence Analysis

• Activities: OSINT (Open-Source Intelligence) gathering.

  • Search Engines: Google Dorking (site:rgpvonline.com filetype:pdf).

  • Social Media/Professional Networks: LinkedIn for employee names/job titles (for social engineering).

  • Public Registries: WHOIS lookup for domain ownership, name servers.

  • Code Repositories: GitHub/GitLab for exposed API keys, credentials, internal IPs.

  • Job Postings: Reveal tech stack (e.g., "Experience with Java Spring Boot & AWS").

• Outcome: Comprehensive profile of the target's technology, employee structure, and potential weak points before active scanning begins.

III. Target System Analysis

A. Understanding System Architecture

• Why Thorough Understanding is Critical BEFORE Exploitation:

  1. Identify Attack Paths: Know network segmentation, DMZ, trust relationships. Can you pivot from a web server to an internal DB server?

  2. Prioritize Targets: A public-facing web server is higher risk than an isolated print server.

  3. Choose Correct Exploits: An exploit for Windows Server 2012 won't work on a Linux Apache server. Understanding OS, services, versions is mandatory.

  4. Avoid Collateral Damage: Prevent crashing critical production systems during testing.

  5. Understand Defense Mechanisms: Know where IDS/IPS, WAFs, EDR are placed to bypass or evade them effectively.

• Artifacts to Analyze: Network diagrams (if available), firewall rules, application architecture diagrams, technology stack documentation.

B. Threat Modeling (Implied)

• Process: Systematically identify threats, vulnerabilities, and required countermeasures.

• Common Framework: STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).

• In Practice: During analysis, ask: "What can an attacker do here?" For a login form: Spoofing (credential theft), Tampering (parameter manipulation), Information Disclosure (error messages).

IV. Vulnerability Assessment Methodologies

A. Vulnerability Scanning Tools

• Purpose: Automated identification of known vulnerabilities (CVEs), misconfigurations, missing patches.

• Categories:

  • Network Scanners: Nessus, OpenVAS, Qualys. Scan ports, services, OS fingerprinting.

  • Web Application Scanners: Burp Suite (Professional), OWASP ZAP, Acunetix. Crawl apps, test for SQLi, XSS.

  • Configuration Scanners: CIS-CAT, ScoutSuite (for cloud). Check against security benchmarks (CIS Benchmarks).

• Limitation: High false positive rate. Scanning ≠ Penetration Testing. Scans find potential issues; manual verification and exploitation are required.

B. Web Application Penetration Testing Methodologies

• Standard: Follow OWASP Testing Guide and OWASP Top 10.

• Phased Approach:

  1. Information Gathering: Spider/crawl the app, identify entry points.

  2. Configuration & Deployment Testing: Check HTTP methods, headers (HSTS, CSP), error handling.

  3. Authentication Testing: Bypass logic, credential stuffing, session fixation.

  4. Session Management Testing: Cookie analysis, session timeout, logout.

  5. Authorization Testing: Horizontal/Vertical privilege escalation (IDOR).

  6. Business Logic Testing: Workflow bypass, price manipulation, race conditions.

  7. Data Validation Testing: SQL Injection, XSS, SSRF, XXE, file upload vulnerabilities.

  8. API Testing: (If applicable) Test endpoints, authentication (JWT/OAuth), rate limiting.

C. Wireless Penetration Testing Methodologies

1. Reconnaissance: airodump-ng to list available networks (BSSID, channel, clients).

2. Packet Capture: airodump-ng or Wireshark to capture handshakes (WPA/WPA2) or traffic (WEP).

3. Attack Vector Selection:

   • WEP: IV capture & cracking (aircrack-ng).

   • WPA/WPA2-Personal: Capture 4-way handshake, offline dictionary/brute-force attack (hashcat).

   • WPA/WPA2-Enterprise: Evil Twin attack, RADIUS server spoofing, certificate bypass.

4. Post-Connection: Once associated, perform internal network sniffing (see below), MITM attacks (ARP spoofing), client isolation testing.

D. Cloud Security Assessment Methodologies

• Core Concept: Shared Responsibility Model. Client is responsible for "Security IN the Cloud" (data, apps, IAM). CSP is responsible for "Security OF the Cloud" (hardware, global infra).

• Methodology:

  1. Enumeration: Identify cloud assets (S3 buckets, EC2 instances, Lambda functions) using tools (ScoutSuite, nmap on public IPs).

  2. Configuration Review: Check IAM policies (overly permissive roles), S3 bucket ACLs/public settings, security group rules (0.0.0.0/0 on port 22/3389), encryption at rest/in-transit.

  3. Container & Serverless: Review Dockerfiles, Kubernetes manifests, Lambda code for secrets, vulnerable dependencies.

  4. API & Service Review: Test cloud provider APIs (AWS CLI, Azure PowerShell) for excessive permissions.

V. Specific Vulnerabilities and Attack Vectors

A. Web Application Vulnerabilities

1. SQL Injection (Primary Risk & Impact)

   • Definition: Injection of malicious SQL code via user input, altering the intended database query.

   • Primary Risk: Data Exfiltration, Modification, or Deletion. Can lead to full database compromise, including user credentials (PII), financial data, and administrative access.

   • Impact: Complete breach of confidentiality, integrity, and availability of data. Can lead to total system compromise via database file write (INTO OUTFILE) or command execution (xp_cmdshell).

   • Example: ' OR '1'='1 in a login field bypasses authentication.

   [!TIP] Exam Focus: Always state the primary risk as data breach (exfiltration) and link it to business impact (regulatory fines, reputational damage).

2. HTTP Strict Transport Security (HSTS) Importance

   • Definition: Security header (Strict-Transport-Security) that instructs browsers to only communicate with the site over HTTPS.

   • Why Crucial? Prevents SSL Stripping Attacks. Without HSTS, an attacker on the network can intercept an initial HTTP request, serve a fake HTTP page, and downgrade the connection, stealing credentials even if the site normally uses HTTPS.

   • Mechanism: Browser remembers the HSTS policy for a specified max-age, forcing future requests to use HTTPS automatically, even if the user types http://.

B. Wireless Network Attacks

1. Packet Sniffing Techniques & Importance

   • Technique: Putting wireless NIC in monitor mode to capture all 802.11 frames on a channel, not just those addressed to it. Tools: Wireshark, tcpdump.

   • Importance:

     • Capture Handshakes: Essential for offline WPA/WPA2 cracking.

     • Analyze Unencrypted Traffic: Legacy protocols (Telnet, HTTP, FTP) transmit credentials in clear.

     • Identify Devices & Users: Map MAC addresses to users, discover hidden SSIDs.

     • Protocol Analysis: Detect misconfigured or weak encryption (WEP).

   • Wireless is inherently broadcast—sniffing is passive and often undetectable.

2. Social Engineering Tactics Targeting Wireless

   • Evil Twin Attack: Rogue AP with same SSID as legitimate one, but stronger signal. Users connect, attacker intercepts all traffic (MITM).

   • Rogue AP with Common Name: "Free Airport WiFi" or "Starbucks_Guest" to lure users.

   • Disassociation Attack: Forced deauthentication of clients from legitimate AP, causing them to reconnect to the evil twin.

   • Phishing via Captive Portal: Fake login page on rogue AP to harvest credentials.

C. Cryptography-Related Attacks & Assessments

1. RSA Algorithm for Secure Communication & Exploitation

   • Key Generation:

     1. Choose large primes $p, q$.

     2. Compute $$\displaystyle n = p \times q $$, $$\displaystyle \phi(n) = (p-1)(q-1) $$.

     3. Choose public exponent $e$ (usually 65537) where $$\displaystyle 1 < e < \phi(n) $$ and $$\displaystyle \gcd(e, \phi(n)) = 1 $$.

     4. Compute private exponent $d$ such that $$\displaystyle d \equiv e^{-1} \pmod{\phi(n)} $$.

   • Encryption: $$\displaystyle C = M^e \mod n $$ (with public key $(e, n)$).

   • Decryption: $$\displaystyle M = C^d \mod n $$ (with private key $(d, n)$).

   • Exploitation Context: Penetration testers may exploit poor implementation:

     • Small/identical prime numbers (factoring $n$).

     • Common modulus attack if same $n$ used with different $e$.

     • Timing/padding oracle attacks (e.g., Bleichenbacher's attack on PKCS#1 v1.5).

2. Decryption Techniques in Penetration Testing

   • Goal: Access sensitive data (cookies, tokens, config files) that is improperly protected.

   • Techniques:

     • Known Plaintext Attack: If attacker knows part of the plaintext and ciphertext, can derive key/algorithm weakness.

     • Chosen Plaintext Attack: Induce system to encrypt known data to analyze patterns.

     • Side-Channel Attacks: Timing analysis, power analysis (more physical).

     • Exploiting Weak Algorithms: Cracking DES, RC4, or misused AES (e.g., ECB mode reveals patterns).

     • Key Extraction: From memory dumps, configuration files, or via vulnerabilities (e.g., Heartbleed).

3. Stakeholder Engagement in Cryptographic Implementation

   • Why Critical? Crypto is pervasive but often misunderstood. Poor implementation (custom crypto, weak RNG, hardcoded keys) breaks security.

   • Engaged Parties:

     • Cryptographers/Security Architects: Design and review algorithms, key management.

     • Developers: Implement crypto correctly (use vetted libraries, not custom code).

     • System Admins/DevOps: Manage keys, certificates, rotation, secure storage (HSMs, KMS).

     • Compliance Officers: Ensure algorithms meet standards (FIPS 140-2, PCI-DSS).

   • Pen Tester Role: Assess if implemented crypto matches design, test for common flaws, verify key lifecycle management.

D. Social Engineering

1. Tactics and Techniques (Including Wireless)

   • Phishing: Fake emails/websites to steal credentials.

   • Vishing/Smishing: Voice/SMS phishing.

   • Pretexting: Creating a fabricated scenario (e.g., "IT support") to gain trust and info.

   • Baiting: Leaving infected USB drives in parking lots.

   • Quid Pro Quo: Offering a benefit (free gift) in exchange for info.

   • Tailgating: Following an authorized person into a restricted area.

   • Wireless-Specific: Evil Twin, Rogue AP (as above).

2. Mitigation through Employee Training Programs

   • Purpose: Transform employees from weakest link to human firewall.

   • Key Components:

     • Awareness: Explain why security matters, real-world breach examples.

     • Simulated Phishing Campaigns: Regular, controlled phishing tests with immediate feedback/education.

     • Clear Reporting Procedures: Easy way to report suspicious emails/activity (e.g., "Report Phish" button).

     • Policy Training: Acceptable Use, data handling, password hygiene.

     • Continuous Reinforcement: Not one-time lecture. Use newsletters, posters, regular micro-training.

   • Outcome: Reduces click-through rates on phishing emails, increases reporting of suspicious activity.

VI. Documentation and Reporting

A. Penetration Test Report Structure

1. Executive Summary: Non-technical overview for management. Key findings, business risk, high-level recommendations.

2. Scope & Methodology: What was tested, when, and how (tools, frameworks like OWASP, NIST).

3. Detailed Findings:

   • Vulnerability Title (e.g., "SQL Injection in Login Parameter").

   • Risk Rating (Critical/High/Medium/Low) based on Likelihood x Impact.

   • Description (clear, concise).

   • Evidence (screenshots, curl commands, PoC code).

   • Affected Asset (URL, IP, parameter).

   • Remediation Recommendation (specific, actionable).

4. Conclusion & Overall Risk Posture.

5. Appendices: Raw scan data, tool output, detailed technical steps.

B. Cryptography Audit Documentation Elements

• Scope of Crypto Components: List all systems using crypto (TLS configs, PKI, encrypted DB fields, VPNs, code libraries).

• Algorithm & Key Inventory: What algorithms are used (AES-256, RSA-2048, SHA-256)? Where are keys stored? Key length? Rotation policy?

• Configuration Review: TLS/SSL configurations (protocol versions, cipher suites, HSTS, certificate validity).

• Implementation Review: Code review for crypto misuse (hardcoded keys, weak RNG, ECB mode, improper padding).

• Key Management Assessment: Generation, storage, distribution, rotation, destruction processes.

• Findings & Recommendations: Specific flaws (e.g., "TLS 1.0 enabled," "RSA keys < 2048-bit," "AES-ECB used for file encryption").

C. Case Study Reporting (rgpvonline.com)

• Executive Summary: "Critical SQL injection vulnerability found in student login portal (/login.php), allowing full database access. High risk of PII breach. Immediate patching required."

• Finding Detail:

  • Title: SQL Injection (Boolean-Based) in username parameter.

  • Risk: Critical (Confidentiality, Integrity impact).

  • Evidence: admin' OR '1'='1 logs in as admin. UNION SELECT dump of users table.

  • Asset: https://www.rgpvonline.com/login.php

  • Remediation: Use parameterized queries (prepared statements). Implement WAF rules temporarily.

• Additional Findings: Missing HSTS header, verbose error messages disclosing path.

• Overall Posture: High risk due to direct database access. Recommend immediate fix and secure coding training for dev team.

VII. Advanced Simulations and Practical Applications

A. Capture the Flag (CTF) Competitions

• Simulation of Real-World Scenarios:

  1. Varied Skill Levels: Jeopardy-style (pwn, web, crypto, forensics, reversing) mimics diverse attack surfaces.

  2. Real Vulnerabilities: Flags are hidden behind actual, unpatched vulnerabilities (CVE-based), not contrived puzzles.

  3. Time Pressure & Resource Constraints: Mimics real engagement timeboxes and limited tools.

  4. Chain of Exploits: Often require chaining multiple flaws (e.g., info leak -> buffer overflow -> shell).

  5. Documentation Habit: Solving requires clear notes, replicable steps—directly transferable to report writing.

• Value: Hones technical skills, lateral thinking, persistence, and research ability under pressure.

B. Real-world Scenario Simulation and Analysis

• Approach: Use isolated lab environments (e.g., VulnHub, HackTheBox, custom VMs) that replicate enterprise setups: AD environments, web apps with DB backends, firewalls, SIEM.

• Analysis Focus:

  • Attack Chain Reconstruction: Document every step from recon to flag/domain admin.

  • Detection Opportunities: At which step could an IDS/EDR/SIEM have alerted? What logs would be generated?

  • Mitigation Mapping: For each exploited vulnerability, list specific patching, configuration change, or architectural fix.

  • Report Writing Practice: Convert the simulation into a formal report as if for a real client.

• Outcome: Bridges the gap between tool usage and strategic security improvement, emphasizing defensive insights alongside offensive techniques.

\boxed{\text{Key Exam Themes: Legal/Scope, Recon (DNS/OSINT), Architecture Understanding, OWASP Top 10 (SQLi/HSTS), Wireless Sniffing/Social Eng, RSA, Reporting, CTF Value.}}