Where? Usually in our own lab or office environment is where we're putting this stuff together on an
isolated system. Generally, especially in DoD, and this time I'm not picking on y'all. Y'all
actually have a very good way of doing this. The pen testing systems that are going to be
utilized during the course of this actual test are basically fresh out of the box, right? So,
we wipe a system completely, and we install all of our tools to include any scripts,
automation tasks, and outside tools that are approved, but that we may need to bring in,
and usually those are brought over by Sneakernet. So, we get them off of open source sites and
other resources, burn them to a DVD, CDD, or put them on a thumbstick, have them scanned if they're
going into a secure area, and for viruses obviously, and then put them on the actual
pen testing system. Because when your system is on that network, whatever network it may be,
you're sending out exploits, and you don't want these exploits to stay persistently after you're
done with the pen test. So, we have a fresh box that we create, and we take to our organization
for pen testing. Now, there's a couple of different ways you could do this, and we're
definitely not covering this in the course. I just want to put this nugget and see what I did there
in the back of your mind. You can create images off of a pen testing system and have them validated
as being fresh box. That way, whenever you do attack an organization that requires no outside
interference from the unclassified network, in this case, you can basically just take a new
hard drive or one that has been authorized and wiped and put in that system and burn the image
to the drive. Therefore, you have your system, and you have a couple of different things to
add to that, like your scripts and whatnot. Some of those scripts may already be there.
You just need to adjust the IP address. I said we wouldn't get into the actual imaging on this,
I may come back to that here in a little bit because that's one of the most overlooked areas
inside of automation for pen testing. I don't want to hit on it too hard because I want to stay
within the Metasploit realm. Why? Long story short, we want to make this as easy on ourselves as
possible. We don't want to be overburdened with a bunch of different tasks that we have to
accomplish within the first few hours of a pen test. Pen testing is kind of like firefighting.
The moment that you get told that there's a fire, you have to get going right away. You have to get
dressed, go down the fire bowl, get to the fire truck, make sure everything's good, and go to that
fire to fight that fire. That being said, you don't just go to a fire truck and it be empty of water
in case you're in a booster tank truck or something like that. So all of that prep work is done at the
firehouse, and you're, let's say, from the beginning to the end, I mean I'm trying to remember here
real quick, your uniform is set up, your oxygen tank is already pre-filled, your sensors are fully
charged, and your communication devices are also fully charged and pre-configured to the actual
frequency that you need to communicate with your team. Then the pole and also the firehouse itself
is configured in such a way to make it as easy as possible to go from bed if you're staying
overnight or if you just got there to uniform to pole down to truck. Now the truck itself is already
pre-filled with fuel, usually diesel if you're here in the states and you have one of the new fancy
dancing fire trucks. Your booster tanks are already pre-filled with water, your other oxygen tanks that
are on board are already pre-filled with O2, and your AED devices and other medical equipment
is already either charged, prepped, sterilized, and put into place in specific order and placement.
So that way you can make it as easy as possible on yourself to go from wake up to fire as quick
as possible with no delay. And there's no difference here as far as a pen test is concerned.
Is it as critical? Depending on the organization that you're actually pen testing. But we try to
make it as streamlined as possible for us to be able to get to that organization and have everything
ready to go. Also from a professionalism standpoint, and I'm just putting this out there because I know
we're all professionals, I just want to give some of the tidbits here. It's always a good first
impression when you show up to an organization even during the interview process of a pen test
and they say what are you going to do? And because most organizations don't exactly know what it is
that we do, and this has always been a constant communication issue. So as pen testers, we want to
go to the organization as prepped as possible and even take some systems with us like a laptop or
something like that. And when they say what is it that you're going to do? We can show them a couple
of demonstrations in a controlled environment to show them that we are prepared right out the gate.
How? And how we do this is through the entirety of this skill. I'm glad you asked. Probably the
easiest explanation that I've had in this introduction video that I realized that I need
to clip up into different sections because it's entirely too long. And that's part of the preparatory
process that we go through even in pen testing because when you make instructions like this for
your fellow pen testers within organizations for things like lessons learned, SOPs, etc.
The how portion that we go through this skill goes into some of those things and creates it
an easier environment for us to be able to conduct pen testing in the future.
So without further ado, let's do it to it!