Everything that we've been doing throughout this entire skill has led up to this portion of this
where we're at, and that is identifying and making sure that we can find sensitive data
or information on the particular systems that we're pen testing. Again, I want to stress that
we're pen testing here, so we're not doing this to hold anybody hostage or do bribes or anything
like that. This is basically just us going through and seeing if we can find any information that has,
for example, like files with passwords on them or files with company information, because our
testing is to strengthen the security of the organization that we're pen testing for,
and if we do find results like this, not only can it play into us better securing the organization
overall, it can also play into us getting more information about the network, because I'm going
to pick on DoD here for a second and not give away too much because it's still at that unclassified
level. A lot of you 255 November's warrant officers in the Signal Corps love to keep network
maps on your desktop. Now, inherently, there may not be any sensitive information on that. It could
be public IP addresses, basic just point-to-point network information for you November to keep in
the back of your mind. Well, where that comes into play for us pen testers is that we may not have
discovered different areas of the organizational's network that's allowed within the scope of our
pen test based on the rules of engagement. So, if we're able to find those files that have the
network maps on there, mostly in PowerPoints in case you're pen testing against a signal unit,
you are able to identify different portions of the network just as an example. Now, it could be that
in your scope for the rules of engagement, using this example, that you have a certain set of IPs
that you're allowed to play with and pen test against. Well, some of these organizations are
geo-dislocated for their different subnets and VLANs, but the network map that you just found
on that warrant officer's desktop allows you to be able to go in and view where those different
subnets and VLANs are in relation to the rest of the network logically. So, while you may not be
able to play with the public IPs that create that IPsec tunnel, you may find a system on the network
map that is a part of that IPsec tunnel and tunnel through there without disturbing the public or
restricted IPs in our pen test for that targeted network or individual system. So, you're using the
stuff that's allowed to play within the scope of the actual pen test itself based on information
that you're finding through the course of doing something like what we've been doing in this skill,
and that is digging for files that have write access to them, digging for files that may not
have an owner to them, because in our example here, folks change out in duty stations in the
army every two to three years, and the DOD policy and standard operating procedure is to not
necessarily delete the account, but to restrict the account just in case somebody decides to take
that role. Now, if the account is deleted, you could start going in and digging for who owns
that particular file or even take over, delete the account yourself, and then recreate the account
using that specified UID or SID inside of Windows and go through and access that information or find
where that information may be being held at, because the same idea can be applied to a domain
environment as well as we have UIDs, SIDs in domain services that allow us to be able to go in
not just with the username, because that's what we see, but it's the actual user identification
number that the system that's holding the file is more concerned about.