Now, if there's one thing I want you to remember more than anything else when
it comes to note-taking is time stamps.
And I'm going to show you an example here in just a second.
But the reason I point this out is because we need to make sure that we're syn
ced with the actual time of the system that we're using or systems that we're
conducting the pen test with and the actual organization that we're doing
conducting the pen test on.
And this is the same for an investigation that we would be conducting on the
digital forensic side of the house.
Because the time stamps don't match up or if there's not a best way to put it
like a footnote inside of our executive summary that states what our timestamp
scheme is, then it could be that the organization that we're conducting the pen
test for thinks that we're outside of our scope in some way.
Let's say business hours or peak hours are from nine to five and the
organization that we're working for doesn't want us conducting pen test between
nine and five.
So basically, five, oh one in the afternoon, all the way up to eight, fifty
nine in the morning and through the night.
And if our time stamps are off and there's no indication that there is a skew
of any kind whatsoever, this could cause problems when we're presenting the
executive summary to those that were who are responsible for paying us.
So let's take a look at an example real quick.
This operating system should be very familiar by now because we're going to be
using it a lot throughout this course and it is Kali Linux.
So let's take a look at something real quick and that is on the top right
corner, sorry, I had to turn my zoom in on you see a little bit of my OBS not
apologize for that.
But you see you up at the top where it says my time is four, fifteen, forty
eight p.m. This is where we get a little bit outside and timescued because I
want to pull this up real quick for my actual system itself.
Right here and right there, you can see that it is six six TPM on the same day.
Now I can verify that it's the same day if we go inside of here and just click
right there. It's May 14 2025.
But that's time is off from what the actual system is showing the host system.
And if I'm conducting the pen test here, I need to account for that and state
that there is a two hour timescue between the actual system that's conducting
the pen test, which is Kali and the host system that we're on this our host
system or whichever system that is that we're going to be attacking.
Now, there's a couple of different things that you need to look out for when
you're doing this. And that is is our system time synced with any kind of GPS
are
a time server, I say GPS because that's where I get my time from. We could go
into properties here and go into time and date settings and you can see here
that it's manually said.
Configuration is manual. And then pull you real quick right there.
And I'm not going to mess with that because inside of VMware, which is where I
'm at right here, I'm moving it over so you could see.
I'm going to right click on the actual VM that we're operating on and go into
the actual settings.
Experiences may vary if you're using virtual box. But if I go into the options
of the actual VM that I'm on and go into VM tools, I'm going to zoom in and
show you here real quick.
You can see that there is a feature that's unchecked inside of the box called
synchronous guest time with host.
And that makes sure that our virtual machine is synced with the actual host
that we're using for our virtualized environment.
Now, this only goes so far as to make to ensure that the actual host itself is
synced.
So that's why I'm using time servers and GPS to make sure that this host system
is good.
So that way the actual virtual systems are good. Now, you can see here, if I
click on date and time again, just like that,
we have our time synced with what's actually on the actual host system itself.
Move that there real quick and then move this over so you can see both at the
same time.
And right there, 618 on both systems, the host and the virtual one.
So in a perfect world, I wouldn't have to account for any kind of time skew
between the system that I'm pen testing with Cali,
which is my virtual about virtualized environment and the target, which is
actually going to be the host system for a lot of this.
There will be exceptions, but that's just because everything's right here in
the same location.
It's important to remember that we're not always going to be in the same time
zone as the actual targets themselves.
Could be that we're a third party pen tester that's located here in Texas
working against an organization for cybersecurity readiness in Eugene, Oregon,
who knows.
But if you're well aware of time zones, you know that Eugene, Oregon is two
hours behind Texas.
So when you're doing your reports and your note taking, it's always imperative
to remember that there either has to be a standardized way of keeping time, let
's say, like GMT or zoom time for your DOD folks out there,
or you account for the time skew in your report by stating that there is a two
hour skew between the target targeted systems and the ones that are actually
conducting the pen test.
So I just wanted to bring that up and let you know that when this is happening,
time stamps are a very critical thing because that can be the make or break
between staying within the scope, also reporting results correctly and seeing
if the
vulnerabilities that you find based on that time are in fact true, but when you
found them.
[BLANK_AUDIO]