Hey, wanna see a magic trick? Watch this. Ahhh. Boom, maybe stolen.
Just like that, something can come up and accidentally disappear and are being
misplaced.
Pintesting isn't always about being able to break into a system that's attached
to
the network. We can sometimes actually take it with us for exploration at an
offline site,
and this is where we start diverting from online to offline. Now, if you have
to keep
in mind that this has to be within the scope of your rules of engagement for
your overall
pen test, because if it's not, then it just turns into a theft. And depending
on the
value of said item, it could be the difference between a misdemeanor and a
felony. Regardless,
they're both illegal. But keep in mind that if it is within the scope of the
rules engagement,
not only do you have physical access to the device itself, but you could see
throughout
the rest of this course as we start getting into analyzing the actual physical
devices
like hard drives and stuff, that we can recover bits of information or break
into said system
with a something more than like a USB thumbstick that has a password breaker on
it. And we'll
definitely explore some options like that. But the whole point behind this is
to get you
to understand that pen testing isn't always about being able to break into
something that's
attached to a network. Sometimes we actually get to play with physical devices
and trying
to break into places using things like social engineering, not just for emails
to click
on a macro, if it will, or download a malicious file, but also to gain access
to not only
still devices borrow devices like the physical laptop or computer system, but
maybe files,
maybe a user has a password on a sticky note. Look in a UDOD. But there are
other things
as well too that you can get from actually being at somebody's location and it
enhances
the physical security that goes along with all the security that's applied to
the actual
IT systems. Because at the end of the day, an actual attacker's not actually
going to
play by the rules that's outlined in a rules of engagement could be that they
're really
malicious and trying their best to break and enter along with all sorts of
different things.
But again, within the scope of our rules of engagement.