HACKERSLIST.US

Vulnerability Assessment And Penetration Testing{VAPT}

Vulnerability assessment is a process in which the IT systems such as computers and networks, and software such as operating systems and application software are scanned in order to indentify the presence of known and unknown vulnerabilities.

As many as 70% of web sites have vulnerabilities that could lead to the theft of sensitive corporate data such as credit card information and customer lists.

Hackers are concentrating their efforts on web-based applications - shopping carts, forms, login pages, dynamic content, etc. Accessible 24/7 from anywhere in the world, insecure web applications provide easy access to backend corporate databases.

VAPT can be performed in the following nine-step process:

• Scope: While performing assessments and tests, the scope of the assignment needs to be clearly defined. The scope is based on the assets to be tested. The following are the three possible scopes that exist.
• Black Box Testing: Testing from an external network with no prior knowledge of the internal networks and systems Gray Box Testing: Testing from an external or internal network, with knowledge of the internal networks and systems. This is usually a combination of black box testing and white box testing
• White Box Testing:Performing the test from within the network with the knowledge of the network architecture and the systems. This is also referred to as internal testing Information Gathering The process of information gathering is to obtain as much information as possible about the IT environment such as networks, IP addresses, operating system version, etc. This is applicable to all the three types of scope as discussed earlier.
• Vulnerability Detection:In this process, tools such as vulnerability scanners are used, and vulnerabilities are identified in the IT environment by way of scanning. Information Analysis and Planning. This process is used to analyze the identified vulnerabilities, combined with the information gathered about the IT environment, to devise a plan for penetrating into the network and system
• Penetration Testing:In this process, the target systems are attacked and penetrated using the plan devised in the earlier process.
• Privilege Escalation:After successful penetration into the system, this process is used to identify and escalate access to gain higher privileges, such as root access or administrative access to the system.
• Result Analysis:This process is useful for performing a root cause analysis as a result of a successful compromise to the system leading to penetration, and devise suitable recommen- dations in order to make the system secure by plugging the holes in the system.
• Reporting:All the findings that are observed during the vulnerability assessment and penetration testing process need to be documented, along with the recommendations, in order to produce the testing report to the management for suitable actions.
• Clean Up:Vulnerability assessment and penetration testing involves compromising the system, and during the process, some of the files may be altered. This process ensures that the system is brought back to the original state, before the testing, by cleaning up (restoring) the data and files used in the target machines.

Network Penetration testing.

The IP address gives the attacker’s Internet address. The numerical address like 212.214.172.81 does not reveal much. You can use PING to convert the address into a domain name in WINDOWS: The Domain Name Service (DNS) protocol reveals the matching domain name.PING stands for “Packet Internet Groper” and is delivered with practically every Internet compatible system, including all current Windows versions. Make sure you are logged on to the net. Open the DOS shell and enter the following PING command:

• Ping–a: 123.123.12.1 Ping will search the domain name and reveal it. You will often have information on the provider the attacker uses e.g.: dialup21982.gateway123.provider.com Pinging is normally the first step involved in hacking the target. Ping uses ICMP (Internet Control Messaging Protocol) to determine whether the target host is reachable or not. Ping sends out ICMP Echo packets to the target host, if the target host is alive it would respond back with ICMP Echo reply packets. All the versions of Windows also contain the ping tool. To ping a remote host follow the required procedure. Click Start and then click Run. Now type ping (For example: ping yahoo.com) This means that the attacker logged on using “provider.com”. Unfortunately, there are several IP addresses that cannot be converted into domain names. For more parameter that could be used with the ping command, go to DOS prompt and type ping /?. Ping Sweep If you are undetermined about your target and just want a live system, ping sweep is the solution for you. Ping sweep also uses ICMP to scan for live systems in the specified range of IP addresses. Though Ping sweep is similar to ping but reduces the time involved in pinging a range of IP addresses. Nmap (http://www.insecure.org) also contains an option to perform ping sweeps.
• Tracert: Tracert is another interesting tool available to find more interesting information about a remote host. Tracert also uses ICMP. Tracert helps you to find out some information about the systems involved in sending data (packets) from source to destination. To perform a tracert follow the procedure below. Tracer connects to the computer whose IP has been entered and reveals all stations starting from your Internet connection. Both the IP address as well as the domain name (if available) is displayed. If PING cannot reveal a name, Traceroute will possibly deliver the name of the last or second last station to the attacker, which may enable conclusions concerning the name of the provider used by the attacker and the region from which the attacks are coming. Go to DOS prompt and type tracert (For example: tracert yahoo.com). But there are some tools available like Visual Traceroute which help you even to find the geographical location of the routers involved.
• Port Scanning: After you have determined that your target system is alive the next important step would be to perform a port scan on the target system. There are a wide range of port scanners available for free. But many of them uses outdated techniques for port scanning which could be easily recognized by the network administrator. Personally I like to use Nmap (http://www.insecure.org) which has a wide range of options. You can download the NmapWin and its source code from: Apart from port scanning Nmap is capable of identifying the Operating system being used, Version numbers of various services running, firewalls being used and a lot more.