In the last couple of skills, we've been talking about actively scanning for
vulnerabilities,
and we even discussed some of the risks that comes along with that in terms of
pin testing.
See, when we actively scan for anything, whether it be an OS fingerprint or
even the
vulnerabilities themselves, we run across the possibility that we may get
caught either from
IDS or IPS rule sets. They can be statically assigned or heuristically assigned
, meaning that
the devices put in place for system and network defense could in fact be
configured to sniff out
traffic like what we're trying to do. See, we're actually going to the
individual systems and
network devices themselves and probing to see what's installed, what type is
installed, and if there
are any holes that are known about. See, we're not really getting into that
zero-day vulnerability
stuff, but we're testing to see if there's any known vulnerabilities. Some
vulnerabilities could
be there for a bit and known and accepted risk by part of the organization, and
some could be
unknown, which is the ones that are fun to play with. But along with that is
the fact that as a
pin tester, we do our best to not get caught to really show and highlight the
security flaws of
an individual network that need to be addressed or fixed by the actual
organization itself.
That's why we're here. We're not here to exploit and be able to go in and
maliciously attacking
network for the fun of it, although that is fun sometimes, but within legal
constraints.
We're here to help improve the overall security posturing of an organization.
And there's ways for us to be able to do this as well under the radar and try
to get as much
information as possible without getting caught, because pin testing is kind of
a cat and mouse
game that we really enjoy playing with between us and the organization that we
're probing.
And in this skill, we're going to be talking about passively checking for those
vulnerabilities
and other bits of information across the network. When we do this passively, we
're not actually
targeting the individual systems or network devices. We're just simply
listening to everything
that's happening on the network as cleanly as possible to be able to take that
traffic back,
analyze it and see if there's any information we can use to further our
investigation for
vulnerabilities, flaws, or whatever the case may be. Now, I'd like for you to
be able to imagine,
if you will, passive vulnerability scanning or any kind of passive scanning
whatsoever on the
network is essentially taking a glass to a door. And on the other side of that
door is a conversation
happening. The glass is basically an amplification device for us to be able to
listen the best we can
to anything that's happening on the other side of that door. And the more that
we listen, the more
tidbits of information that we can be able to pick up that we might be able to
use throughout the
rest of our pin testing cycle. And this is still under the scanning phase of
that pin testing life
cycle. See, I want to specifically bring that up because all throughout this
course, we're going
to be addressing where we're at in the pin testing life cycle. So that way, one
, not only can we
remember it for, you know, studying purposes, but two to also remember where we
're at. And we may
have to come back to this later on, because despite us listening to that door
through the glass,
we may not get all tidbits of information. We may get enough for us to be able
to continue
through the pin testing life cycle, but then have to come back and listen to
the door again
to see if there's any other stuff that we can listen to. Now, why is this? Well
, there's a couple of
reasons that I can think of off the top of my head. Reason number one, not all
devices may be on
right now. Whenever we do our passive or even active scanning, some devices may
have a certain
timeline that they operate. This could be web servers, this could be individual
clients, this
could any type of service that's on the actual network itself that is ran and
operated by the
organization that we're pin testing against. We don't always keep things on 24/
7. Let's say there
are some client devices out there that don't necessarily need to be running all
the time. It
could be a power saving method that the organization we're pin testing against
is using. So if all
those devices are in sleep mode, or let's say they're just completely shut off,
we wouldn't be able to
properly probe or test those individual systems right away. So if we only scan
once and we only
recon once, there's a huge chance that we're not going to be able to see every
single device that
we are trying to address within the scope of our actual pin test. The other
reason may be that
there is a particular cork about the system that doesn't allow us to
necessarily scan that
individual device, for instance. Let's say that there is a workstation on the
actual network itself
that is a part of the organization that we're supposed to be pin testing and it
's within the
scope and rules of engagement for us to be able to probe. But for whatever
reason, this particular
system is using a VPN or IP sector or whatever the case may be to be able to
identify a new IP
address and not be identifiable during the initial reconnaissance or scanning
of the actual network
itself. It could be that this is a client that's required to get to a different
part of the
organization that's geo dislocated or whatever the case may be. But this goes
back to what we were
talking about while ago in that we may need to be able to recon and scan and
check for vulnerabilities
more than once throughout our actual pin testing and re-address the actual pin
testing lifecycle.
Now all that comes back to us being able to move on to the passive
vulnerability scanning portion
of this course. And that's where we're going to be doing this alongside of our
active scanning
techniques, but trying to do this in a way to where we don't actually probe the
system itself.
And there are many different ways to do this, but we also have to have a firm
understanding
of the actual network and organization itself, which we're going to cover in
the next portion of
of this skill. So let's go ahead and do it to it.