PENETRATION TEST
They try to infiltrate and capture the IT infrastructure of an institution / organization using methods used by cyber criminals in the real world. Thus, by thinking as a hacker, applying the infiltration and capture scenarios to the system and trying all the methods that attackers can try, they determine that the vulnerabilities of the system are repaired and the security tightened when a real attack is encountered. Licensed or open-source code tools are used in penetration tests, and all vulnerabilities are detected as much as possible by applying institution-specific manual tests as well as automated scanning tools.
Purposes of penetration tests:
– To reveal the risks and threats that exist in the institution’s networks and systems
– Deep detection with internal and external vulnerability and vulnerability scanning
– Providing usable data to audit teams that collect data for compliance with standards
– Detection of patches suitable for known vulnerabilities and openings
– Evaluating the efficiency of firewall, routers, web servers and network security devices
– Identifying the actions that can be taken to prevent future attacks, infiltration and abuse attempts
– To determine whether the existing software-hardware or network infrastructure needs a change or upgrade
Systems to be taken into risk assessment:
– Communication and e-commerce services, systems that carry out the transmission and storage of sensitive information
– Web sites, email servers, remote access platforms
– DNS firewall, passwords, FTP, IIS and web servers
– Customer-owned systems
– Etc.
Penetration Test Methodology
Pre-engagement Interactions: Coverage, how long the test takes to complete, what to test, and additional support for things not specified in the scope
Intelligence Gathering: Gathering information about the entry points of the institution in order to create a strategic attack plan about the institution to be pentested.
Threat Modeling: At this stage, the identification and categorization of assets, the identification of threats and threat communities, and the creation of threat models that center the organization’s assets and attackers against it with the help of categorization processes.
Vulnerability Analysis: Detection of system and application vulnerabilities that will cause attackers to exploit
Exploitation: Finding the central management points of the institution by accessing the system and resources by bypassing security restrictions and detecting damages to high-value assets
Post Exploitation: Detection of controls to determine the value of the information contained in the captured machine and use the machine for other targets in the network
Reporting: Including all technical details about the test and the assets and components agreed on for testing in the report and presenting the scope, information, attack technique, methods used, impact and risk degree and improvement suggestions.
Penetration Test methods
Blackbox: No prior information is given about the structure and / or system where the penetration test will be carried out.
Whitebox: Information is given about the entire structure and / or system within the company / institution.
Graybox: It is a penetration test method between ‘Whitebox’ and ‘Blackbox’. No detailed information is given about the structure and / or systems.
Penetration Test Types
– Web Application Penetration Test
– Network Leakage Test
– Mobile Penetration Test
– DOS / DDoS Penetration Test
– Wireless Penetration Test
– Social Engineering Penetration Test