We opened up this course by diving into the pen testing lifecycle and the five
different phases of it.
Now you may remember that we briefly touched on it overall. You can actually
see it. I got it pulled up right here.
And we really dive deep into the recon portion of the lifecycle overall.
And I mentioned that we would be nickel and diamond our way through this lif
ecycle as we continue to out the course.
I didn't really want to dedicate a whole skill to the lifecycle overall because
going through the different courses that we have for cyber security and IA and
all the other great stuff here on CBT nuggets.
This is hammered in pretty well. And I also wanted to touch on it step by step
as we continue throughout the course to be able to add some meaning to those
different parts of the lifecycle.
And in this portion of the course, we dive into the skill that introduces us to
the actual scanning.
See in reconnaissance, we were just identifying ourselves and getting
introduced to the network and different systems overall.
We started talking about the rules and engagement and understanding the
different systems that were allowed or not allowed to be pen tested inside of
our scope and whatever exceptions there may or may not be.
Well, now that we've got everything identified, or we should by this point, we
're moving on into actual scanning and there are two different types of scanning
.
There's active and there's passive. And I'll touch on that here in just a
second.
But when we go into scanning, we're talking about understanding the actual
system itself.
See in recon, we use in map to able to do a thing called OS fingerprint or kind
of best guess our operating system that we were working with on a particular
system or sister who's across the different networks.
Here, we're actually going to start diving into more information about the
system and possibly what vulnerabilities that system they have for us exploit
later on in the actual lifecycle of pen testing.
Now, I did mention that there are two different types of scanning. There's
active and passive and we're going to start off with active first, because
really, it's probably the easiest of the two because in active, you're actually
going out to the system and listening to it and get a scope of what's actually
happening with that system overall.
We're using tools like this is in this skill to be able to go to the system and
do a complete vulnerability assessment or whatever other assessments that we
decide to use to get that particular system.
We are actively scanning that system, whereas passive is more of a sit and wait
type of thing.
And when we get into the skill, the next skill following this one about passive
scanning, we'll start to see why it takes so long to be able to do passive
scans and really it's more of a patient's game, because you don't really go out
to the system
itself, you're waiting for the system to make noise on the network and
listening to what's actually happening as it's talking. Now, there are pros and
cons to do it an active or a passive scan. For instance, we just mentioned
about speed.
If we do an active scan against a system or multiple systems on a network, we
can generate results pretty quick based on how fast we want that scan to occur.
As we saw in the recon portion, we can time our in map suite to be either
really quick or really slow. And the reason that we did that was to kind of
circumvent any IDS or IPS protections that may be on host or the network.
Because if the rules are made on IDS or IPS to say traffic recognition and get
multiple packets per millisecond from one single device that's going to
multiple points on the network, that may be an indication that there's a
network sleep happening of some type.
And the rules would be to, let's say, block that one particular point that's
causing all that traffic could be that it's saying in its heuristic rule set
that it's thinking it's a DOS attack or even a DDOS attack.
Well, the same thing can be interpreted with an active scan. If you're actively
scanning a target system and you're doing it really quick, you can sit, look at
the traffic to be generated and we will how fast those packets are coming
across the wire in terms of multiple
multiple things happen at the same time that you normally would not see on an
actual network. Another drawback from an active scan is that even though you
are going to the system and doing a sleep on it to try to get an assessment of
maybe different software, the different
protocols that are being ran on that system. You're not exactly listening to
the traffic going in and out of target system.
Because you're going to it, whereas on a passive scan you're listening to the
traffic going back and forth.
And this can get a garner even more types of information that would be really
beneficial to our pen testing lifecycle of a whole.
For instance, if we're doing a passive scan, we're just listening against one
single system and not really touching it. We're just monitoring the traffic
from point A to point, wherever we could see that, let's say system that A has
no real servers or services being ran on that system, but it is reaching out to
multiple different parts of the network that run those different types of
services.
Could be reaching out to the DNS, the exchange, the web server, the database,
etc, etc. And by passively listening to that traffic, we can look at the packet
headers and see that there are multiple different points on the network, aside
from the one we're just listening to.
And in the skill following this one, when we do dive deeper into passive
scanning, we'll take a look at how to actually set that up in lab environment
so that way we can passively scan our targets.
Now with all that being said, I said we were touching Nessus in this one, and
we're going to start introducing ourselves to Nessus, the installation of it,
the use of it, and understanding what it is that it does and what information
we can get out of it to break those systems later on.