All right, so penetration testing, execution standard, it's a specification document which is redefining
the penetration test for both new and experienced penetration testers.
It has been adopted by several leading members of the security community.
So therefore, if you feel you are new to penetration testing standards or uncomfortable with the terms,
please have a look at it.
The penetration testing execution standard, I believe, will be the best one for you to go from.
Now, I know that last sentences sounds like an advertisement, but you're not going to lose anything
if you check some of these documents once.
OK, so PTSA is divided into seven phases.
Let's have a look at each of them briefly.
Pre InterAction's, so the pre InterAction's, typically, that's the phase that you discuss, the scope
and the terms of the penetration test and convey your goals of the engagement with your client while
discussing the scope of the penetration test, you should clarify all the domains that will be tested,
as well as any special requirements that are going to be needed, such as special privileges and.
The access to the critical systems and so on, so forth.
That's why you're going to develop your own way of keeping track of it all.
The expected positives of the test should also be part of the discussion with the client in this phase.
Great.
So now this is what you should do before testing begins, intelligence gathering, the information or
intelligence gathering phase or reconnaissance.
As I talked about earlier, it's one of the most important phases in penetration testing.
If you are properly gaining knowledge about your target from social networks, Google or any other way
that you can accomplish, you're going to be able to simulate appropriate and exact attacks rather than
trying all possible attack vectors.
This will also help you save a huge amount of time as well.
So it I believe anyway, it's a duty of a penetration tester to gather enough information about the
target by performing a variety of scans.
So that includes looking for open ports, identifying services, running on those ports.
And you're also going to be able to discover what vulnerable services exist.
I find this phase particularly important, so in Métis Floyd framework, there are many auxillary modules
that enable you to gather information from the target.
Now, the next phase is threat modeling.
So this phase focuses on categorization and modeling of the threats based on their impact on the system.
Now, in my point of view, this phase is not necessarily always applicable.
It depends upon how much time you have.
If you are performing a long term red team, activity modeling threats are going to work for you.
On the other hand, in an ordinary situation, you probably don't have the time to model a threat.
You're going to look rapidly for a way to exploit and gain access to the system.
So our next phase will be vulnerability analysis.
Now, in this phase, you analyze the target network and make a vulnerability scan over that network
to identify all of the weaknesses.
Once again, this is a very important phase.
It's also what I would call a stepping stone into the exploitation phase.
So the next phase is exploitation.
Either manually or automatically, you will detect vulnerabilities for this network.
In this phase, you'll identify which vulnerability is applicable, if possible, and then you run the
appropriate exploit for this particular vulnerability.
Now, being successful in this phase means that you have access to the system.
Believe me, you will be satisfied.
And now it's time to gather some extra information.
So this next phase is called post exploitation.
After gaining access to the target.
You will look for some extra information and use some advanced ways to maintain your access.
Now, this phase, if you haven't ever done it before, is is going to be really mind blowing for you.
And then our last phase is reporting.
So you've done a whole mess of things, OK, so you've exploited the target, maintained your access
and and all kinds of things.
Now to a client, this might not even seem like much you might not even have been detected by the client.
So you have to report on what you have done on the system in a proper way.
So it's important for this to make absolute clear sense and otherwise clients, they're pretty much
going to wonder what you actually do.