SOP for Penetration Testing

This document provides a standard operating procedure (SOP) for conducting penetration testing. It covers the stages of intelligence gathering, vulnerability analysis, exploitation, post exploitation, and reporting. The document also includes a discussion on the methodology of penetration testing and the different types of tests.

University
Semester
PENETRATION TESTING
Student ID
Student Name
Submission Date

Table of Contents
Task 2 SOP for Pen - Testing................................................................................................................3
1. Pen Test Methodology Discussion.............................................................................................3
2. SOP for Pen Testing..................................................................................................................3
3. Decision Making Tree................................................................................................................5
Task 3 - Penetration Test......................................................................................................................5
3.1 Attacking Narrative...............................................................................................................5
3.2 Information Gathering........................................................................................................18
3.3 Scanning and Enumeration.................................................................................................19
3.4 Vulnerability Exploiting......................................................................................................22
3.5 Vulnerability Mitigation......................................................................................................22
Conclusions and Reflections...............................................................................................................24
References...........................................................................................................................................25

Task 2 SOP for Pen - Testing
In this project, we shall be creating a SOP (Standard Operating Procedure), and then do the
test comparisons between the various Penetration Testing techniques. We shall describe the
below given various stages of a Decision making tree,
 Vulnerability Analysis
 Intelligence Gathering
 Vulnerability Identification
 Target Exploitation
 Post exploitation
All the above shall be discussed further.
1. Pen Test Methodology Discussion
“Penetration Testing”, popularly called as “Pen Testing” or “Ethical Hacking”, is the
practice of examining a computer system, network, mobile application, developing software’s,
online tools, or web application for locating security vulnerabilities and safety soft spots that an
potential attacker might exploit. Penetration testing can carried out both, by automation with
software applications or performed manually.
Pentest tools can scan codes for checking the possibility of a malicious code present that may
lead to the likelihood of safety & security breach. Pentest tools can examine the security
loopholes of a given system by testing the data encryption procedures and determining the hard-
coded parameters for example the password/ username. The Penetration Test types includes the
following types,
1. Social Engineering Test:
2. Web Application Test
3. Physical Penetration Test

4. Network Services Test:
5. Client-side test
6. Remote dial-up war dial:
7. Wireless security test
During the process of the Pen Testing, all the devise under examination shall undergo the
exploitation of their safety parameters like firewalls to, analyse the potential vulnerabilities and
linked risks that will put the entire system to further damages.
The below given stages are for the penetration test of SOP (Berdeaux, 2014),
 Intelligence Gathering
 Exploitation
 Vulnerability Analysis
 Threat Modelling
 Reporting
2. SOP for Pen Testing
Below are the different stages as part of the testing by using the SOP for Pen Testing is used,
 Intelligence gathering
By collecting the data intelligence and data assistance in the actions of the
assessment, this stage is utilized for handling the assessment action. Assisting in the aid of
getting the vital access to the vital data and intelligent information related to the target,
intelligence collection is carried out for the sole purpose of gathering all the necessary data
and information about the organizations staff and workers.
 Threat Modelling
In this stage, we shall consider the alternate routes which can be utilized for
avoiding and reduction of the after affects in the system organization, thus in this stage
we will be able to recognize the criteria for vulnerability in keeping the efficiency of the
security of the network. For maintaining the security level in the system, threat modeling
is utilized for identifying the best methodology in keeping the security at its highest level.

 Vulnerability analysis
For recognizing and analysing the risks possibilities for the safety and security by
knowing the systems vulnerabilities, we shall make use of the vulnerability evaluation
and this again is divided into two subsets, vulnerability validation and vulnerability
identification. The difference between these two vulnerability evaluations is,
“Vulnerability Identification” shall be utilised for identifying the vulnerability and
this remains the main goal for the analysis of vulnerabilities.
“Vulnerability Validation” shall be utilized for the reduction is used to reduce and
pick up only those vulnerabilities that are actual affecting the system.
 Exploitation
In this stage, we shall look at the breaching of the security of the system and how
this is exploited by recognizing the system vulnerabilities by making use of the
“Vulnerability Analysis”. Now, to make sure that the identified vulnerabilities are
actually exploitable for the system, we shall carry out the “System Exploitation”
procedure for the exploitation of system vulnerability. As this involves complicated
procedures and also intensive manual testing methodologies within the system, it is a
time consuming process. Some of the methods used are SQL injection technique,
Overflow method, OS commending etc.
 Post Exploitation
The term “Post Exploitation” is used for the stages for the operation when the
users system has been breached by an attacker. To understand as to how will the attacker
utilizes the information for malicious reasons; the worth of the breached system is
calculated by the worth of the actual data stored in it.
 Reporting
The organization whose system has been breached will make use of the reporting phase as to
locate and know as to the vulnerabilities which can be acceptable and understood. To get the
same impact, it shall also consider the deficiencies that let an attacker to exploit the explicit

security policy for getting the same type of impact. As along with the normal system
operations vulnerabilities, it shall also be utilised for gaining entry at higher levels or
interferes.
3. Decision Making Tree
Below is the image for the “Decision Making tree” which shall be utilized in the Penetration
test,
Task 3 - Penetration Test
In this stage of our project, we shall be making use of the Linux Machine to evaluate the
Penetration Test on the system. By making use of the penetration tests methods we shall carry
out the following tasks on the target machine,
 Information gathering.

 Vulnerability scanning.
 Vulnerability exploiting.
 Vulnerability mitigation (Halton et al., 2017).
3.1 Attacking Narrative
In this stage, we shall be utilizing the VMware Workstation and to this we shall add the
Metasploit Virtual machine and Kali Linux.
Next, we shall start with Kali Linux by pressing the “power” tab as shown in the below image,

Below image is representing when the “power” button is clicked for opening Metasploit LUI.

Next, to set up network setting, open the VMnet3 setup.
Both Metasploit & Kali can carry out this procedure.
Next, we shall configure in Kali Linux, the IP address.

Same way, we shall configure in Metasploit, the IP address.
Next, in Kali Linux, we shall restart the network processes.

Next, use the restart command on the Kali Linux output once the issuing is done on the network.
Representing the below given image for the restarting process for Metasploit Network.

Next, is to type in the below code, for restarting of the network process.
“sudo ifconfig eth0 192.168.0.60.”
Next, to confirm that the IP configuration is working, enter the ifconfig command,

Next, on Kali Linux, ping the new configure.

Next, the image below shall represent the outcome from the targeted Metasploit box by making
use of the NMAP command.

The blow image displays the output of the NMAP,
Below shows the output of the Verbose NMAP,

Below, displays the representation of the Verbose output with the –O switch.
Next, the below image represents the NMAP output from the –v switch and the -O switch.

Below image represents the NMAP command with the -V switch and -O switch. Also the image
displays the -v switch.

Below image represents the NMAP to ping the target host.
Below image represents the Port scan for all the hosts within IP field,

3.2 Information Gathering
Now in this stage, we shall carry out the below mentioned steps, for the implementation of the
penetration test for the targeted machine.
Scanning with Nmap: By entering the below mentioned command we can find out the targeted
IP loop holes on the Target machine.
Nmap -0 –sS 192.168.0.181
3.3 Scanning and Enumeration
By utilizing the airbase-ng, the first attack attempts to penetrate and retrieve WEP key by
using the clients account details in the operating system and, by making use of the “Penetration
Scanning and Enumeration” technique.
For the penetration activities, the codes utilized are displayed below and also the image
shows the results of the penetration activity (Henry, 2012).

Hirte Attack
Outcome
Below is the outcome of the successful implementation of the penetration activity on the client’s
computers.
Caffe Spasm

Result
The procedure for recovering the system password required for the WI-FI connection has
been started in the second attempt.
Below is the image as the procedure was completed successfully.
Hydra attack
The process was an attempt for retrieving the password as the second attack for the
penetration scanning and enumeration. Various email accounts were utilized in an attempt to get
the password as part of this particular test. We had used the procedure of “Penetration Test” to
carry-out this function and this was successfully done as can be seen from the below image. We
can clarify and observe the successfully implementation of the penetration process in the system
by making use of the command prompt after the penetration attempt.

3.4 Vulnerability Exploiting
Command injection vulnerability
Utilized for enabling a malicious parameter which is competent in putting the place of the
DHCP server or even able to do spoofing for the DHCP responses on the area network for
executing the commands with root privileges, the “Command Injection Vulnerability” was
discovered in the DHCP (Dynamic Host Configuration Protocol) shopper enclosed by the Red
Hat Enterprise UNIX. By easily exploiting the unauthorized foreign offenders, it helps in
identification of the vulnerabilities.
Outdated applications
Running on the noncurrent codes like PHP, VNC, Apache, Open SSL, and MySQL, the Linux
exploitation is used for expediting via the systems. Noncurrent applications which, are making
oversized footprints and are also malicious with the intention to exploit, get illegal means of
access into the system, by using the patches which have been missing in the Operating System.
Unsafe, associated and unsecured channels of communications (wireless networks) are the easy
points where potential attackers like third parties will make attempts to gain unsanctioned entry.
Lack of system hardening

FTP (File Transfer Protocol) allows the access to sensitive information reports, data,
documents, confidential notes, communication data etc which is inclined for blocking, while
SNMP (Simple Network Management Protocol) shall be running on the default settings for the
network. Everyone in the system will have the access to the administration details by making use
of the unprotected Samba allowing all details like clients account count, name etc easily exposed
for hacking.
Lack of back up
Having knowledge about the backups, the UNIX security has vulnerabilities. Linux-based
frameworks square measures the commonly thought of non-basic as there is a confidence that
quantity of issue is bound by. Large frameworks like Net servers, syslog servers, and FTP
servers are used in the system. These networks work on the systems like UNIX frameworks and
also they have the file copy backups of the same system. Backing up ensures that data is easily
recoverable and operations. A large number of data loss incidents can be prevented.
3.5 Vulnerability Mitigation
Command line injection
Command injection is basically injection of operating system commands to be executed through a
web-app. The purpose of the command injection attack is to inject and execute commands specified by
the attacker in the vulnerable application. In situation like this, the application, which executes unwanted
system commands, is like a pseudo system shell, and the attacker may use it as any authorized system
user. However, commands are executed with the same privileges and environment as the web application
has. Command injection attacks are possible due to lack of correct input data validation, which can be
manipulated by the attacker (forms, cookies, HTTP headers etc.).
Outdated applications
For restricting in getting the administration which is only available when the overseers
are kept in the perfect positions so they are not misused in connections, as the reason for clients
to establish system firewalls. They are performing the inspection of data by self-exchange and
the application firewalls sell this case. To use these systems, the firewall applications require
discovering malicious data parts. Also, this can be deceitfully misguiding for the given
application with the detection rules giving normal assistance to general, heuristic principles.
Lack of system hardening

To gather the entire framework together that is secured as a potential, supported setup
sections for the fundamental demonstration in solidifying of the given server. Following the
bearings of the venders which are not secured as it should be, for reasons unknown, you will
discover those default establishments even once. It will probably flop any review in the event
that you use a default establishment, as an issue of the real world, on the off chance that you are
accessible contact with offenders.
Lack of back up
To give the assistance and useful aid for the virtual machines, the measures of Linux
knowledge backup product is required. Together with UNIX working framework servers, these
have the capacity to discharge in quite a long while as server virtualization has begun on a wide
range of servers. Regularly provide the secure mistreatment as respects to any backup system
which including shell contents in spite of the fact that virtualized frameworks. Used to provide
the UNIX operating system backup of their collections, the Cloud backup is used to have
additional capacity.
Conclusions and Reflections
We have successfully evaluated the penetration test as part of this project. SOP testing for
Penetration test and Penetration test on Kali Linux were the two tasks which were part of the
project. Attack decision Tree for the Penetration Test and examination of the standard operating
procedure were part of the 2nd task. On the Kali Linux machine, as part of the 3rd task, we have
effectively analyzed the penetration testing. For testing a web application for finding the security
vulnerabilities that an attacker could abuse, in most part, this Penetration testing is called the pen
testing or ethical hacking.
The following tasks were completed effectively for the target machine by using the
penetration tests methodology,
1. Information gathering.
2. Scanning enumeration.
3. Vulnerability scanning.
4. Vulnerability exploiting.
5. Vulnerability mitigation.

References
Berdeaux, D. (2014). Penetration testing with Perl. Birmingham, UK: Packt Publishing.
Halton, W., Weaver, B., Ansari, J., Kotipalli, S. and Imran, M. (2017). Penetration Testing.
Birmingham: Packt Publishing.
Henry, K. (2012). Penetration testing. Ely, Cambridgeshire, U.K.: IT Governance Pub.