Penetration testing and vulnerability assessment

Talk given at HELMo Liège.

Transcript

1. Penetration testing and vulnerability assessment
2. $ whoami Quentin Kaiser Student @ UCLouvain / hacker / freelance / security consultant Qkaiser on twitter and #IRC contact@quentinkaiser.be
3. Disclaimer All methods, tools and processes presented in this talk are meant for educational purpose. I won't be responsible for the CCU knocking on your door if you misuse these. I <3 gifs Slides are on speakerdeck at http://speakerdeck.com/qkaiser Find a film, get a cookie
4. WTF IS PENTESTING ?!
5. Processus
6. Stage 1: Discovery / Identification Stage 2 : Vulnerabilty Assessment Stage 3 : Exploitation Penetration testing Stage 4 : Analisys & Reporting Stage 0: Negot. Stage 0: Negot.
7. Rules of engagement
8. Rules of engagement > Attack scope
9. Rules of engagement > Attack vector
10. Rules of engagement > Attack vector
11. Rules of engagement > Attack vector
12. Rules of engagement > Attack vector
13. Rules of engagement > Circle of trust
14. Rules of engagement > Pwn level
17. Rules of engagement > Paperz ! Non Disclosure Agreement
18. Rules of engagement > Paperz ! Out of jail card
19. Rules of engagement > Paperz ! Insurances
20. Stage 1: Discovery / Identification Stage 2 : Vulnerabilty Assessment Stage 3 : Exploitation Penetration testing Stage 4 : Analisys & Reporting Stage 0: Negot. Stage 1: Discovery / Identification
21. Inteligence gathering
22. Inteligence gathering OSINT HUMINT Footprinting Protection mechanism identification
23. Inteligence gathering OSINT HUMINT Footprinting Protection mechanism identification
24. Inteligence gathering > OSINT Pastebin / Github / the Internet !
25. Inteligence gathering > OSINT Maltego / Palantir
26. Inteligence gathering > OSINT Maltego
27. Inteligence gathering > OSINT ShodanHQ
28. Inteligence gathering > OSINT Geolocation
29. Inteligence gathering > OSINT Recon-ng
30. DEMO TIME !
31. Inteligence gathering OSINT HUMINT Footprinting Protection mechanism identification OSINT HUMINT
32. Inteligence gathering > HUMINT Social networks Social Engineering Social Engineering Toolkit
33. Inteligence gathering > HUMINT Social Engineering
34. Inteligence gathering > HUMINT Social Engineering Toolkit
35. DEMO TIME (AGAIN) !
36. Inteligence gathering OSINT HUMINT Footprinting Protection mechanism identification
37. Stage 1: Discovery / Identification Stage 2 : Vulnerabilty Assessment Stage 3 : Exploitation Penetration testing Stage 4 : Analisys & Reporting Stage 0: Negot. Stage 2 : Vulnerabilty Assessment
38. Inteligence gathering > Footprinting Nmap / zenmap / dnmap
39. Inteligence gathering > Footprinting Nessus
40. Inteligence gathering > Footprinting Nessus
41. Inteligence gathering > Footprinting wardriving
42. Stage 1: Discovery / Identification Stage 2 : Vulnerabilty Assessment Stage 3 : Exploitation Penetration testing Stage 4 : Analisys & Reporting Stage 0: Negot. Stage 3 : Exploitation Penetration testing
43. Exploitation
44. Exploitation
45. Exploitation Handcrafted exploits
46. Exploitation Common Vulnerabilities and Exploits (CVE)
47. DEMO TIME !
49. Stage 1: Discovery / Identification Stage 2 : Vulnerabilty Assessment Stage 3 : Exploitation Penetration testing Stage 4 : Analisys & Reporting Stage 0: Negot. Stage 4 : Analisys & Reporting
50. Reporting
51. Question ?
52. Useful resources http://news.ycombinator.com http://securitytube.com Mailing-lists : - bugtraq - infosec news - full-disclosure Go to your local hackerspace ! (around ~10 in Belgium)
53. Credits