Vulnerabilities / Threats
9/23/2013
02:46 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%
Repost This

Penetration Testing For Beginners

Interop workshop instructor discusses what it takes for networking pros to start wrapping their arms around security testing basics

As experienced networking professionals with beginner security skills seek to dip their toes in the waters of penetration testing, step one is to look at their network infrastructures through the eyes of an attacker.

Click here for more articles from Dark Reading.
Click here to register to attend Interop.

"Put people in attackers' shoes, and they'll learn to defend their networks better," says Steve Pinkham, a security consultant for Maven Security Consulting and the guy behind the Web Security Dojo project. "Plus, let's be honest, it's fun to break things, especially when you usually build and maintain things all day."

Breaking things will definitely be on the agenda when Pinkham and colleague David Rhoades hit the ground in New York for Interop. The pair plan to lead a workshop for beginners, titled "Hands-On Introduction to Common Hacking Tools," that will push attendees to think like attackers while getting hands-on experience with the types of tools that both white hat and black hat hackers use to compromise enterprise systems. The class, Pinkham says, will walk through basic attack tests while using the penetration testing execution standard as a platform.

[Do you see the perimeter half empty or half full? See Is The Perimeter Really Dead?.]

Students will be exposed to how penetration testers use tools such as Kali Linux, OpenVulnerability Assessment System (OpenVAS), Nmap, Metasploit, and Maltego to help them get a better picture of how to assess a network for security.

"You need to deeply understand your network and how everything interacts," Pinkham says. "What happens typically is that everybody lives inside their silo inside the corporate world, and there's not often someone who does a good job of integrating everything to find bigger-picture flaws. There's always some old box that's totally forgotten. That's a lot of what we in the security industry do. I draw a big map and figure out how different parts of that map interact."

Whether they're students in his workshop at Interop or those who seek to learn more about penetration and security testing elsewhere, Pinkham emphasizes the importance of hands-on learning when starting out.

"Really, the only way people seem to get it is to either do it themselves or have someone else demonstrate how it happens," Pinkham says. "You want to give people free tools online and a real-world target. They're going to pop a shell on it, extract data from it, and do all these things to break it themselves."

He also believes beginners should understand that if they know where to look for free tools, a lot of the heavy-lifting is done for them through automation. In particular, networking veterans such as those at Interop should seek to get more from Nmap than they may even know is possible.

"Nmap is so good -- every other tool takes its data and goes from there," he says. "So you run your Nmap scan, and then you can import it into Metasploit, you can import it into OpenVAS, and all of these other tools and get further integration."

Not only that, Pinkham says, but Nmap is becoming a very good vulnerability assessment tool in and of itself.

"It has tons of scripts built in, and there's more coming out every day that look for a lot of the low-hanging fruit," he says. "When you have new advisories come out, there's often an Nmap plug-in that will be out in a few days, and you can look through your network and see if you have any of those just using that tool."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web