M.Sc. (CA) Semester 3 Course Name & Code: Penetration Testing (040020305) Tedi Heriyanto, Shakeel Ali, BackTrack 4: Assuring Security By Penetration Testing, Shroff/Packt Publishing is abbreviated as ST, #refers to the chapter no. (E.g. #1 means chapter 1) Objectives: To understand installation and configuration of Backtrack, security testing methodology for planning and implementing penetration testing and comparative study of various tools and techniques for security in penetration testing. Course Outcomes: CO1: CO2: CO3: CO4: CO5: CO6: CO7: CO8: CO9: Sub Unit Understand basics of Backtrack to begin with penetration testing process. Learn how to get, install, configure, update and add tools in backtrack environment. Comparative study of security testing methodologies namely OSSTMM, ISSAF, OWASO, WASC-TC. Analyse the necessary guidelines required on formalizing the test requirements within the scope. Learn several tools and techniques that can be used to gather metadata from various types of documents, extract DNS and routing information. Study the process of discovering and fingerprinting your target and basics of target enumeration. Understand different security concepts that can assist in finding security vulnerabilities. Learn the tools and techniques for escalating privilege, network sniffing and spoofing. Know the tools and techniques for protocol, proxies and end-to-end communication along with the testing directives for documentation, reports and presentation. No. of Lecture (s) Topics 1 Beginning with Backtrack 1.1 1 Backtrack purpose 1.2 1 Getting and Using Backtrack 1.3 1 Configuring network connection 1.4 1 Updating and Customizing Backtrack 1.5 1 Types of penetration testing 1.6 1 Vulnerability assessment versus penetration testing 1.7 1 Security testing methodologies 1.8 1 Backtrack testing methodology Reference chapter/ Additional reading ST#1 pg no 9 to 11 ST#1 pg no 11 to 20 ST#1 pg no 21 to 24 ST#1 pg no 24 to 28 ST#2 pg no 38 to 39 ST#2 pg no 39 to 40 ST#2 pg no 41 to 50 ST#2 pg no 51 to 55 Teaching Methodology Planned Text book & Demo Conceptual reading from textbook Presentati on Conceptual reading from textbook Followe d Date of Lecture Conduction Planned 7/7/2014 15/7/2014 17/7/2014 18/7/2014 8/7/2014 10/7/2014 14/7/2014 11/7/2014 Actua l Evaluati on Paramet er 7/8/2014 QUIZ - 1 Page 1
2 Target Scoping and Information Gathering 2.1 1 Gathering client requirements ST#3 pg no 62 to 64 2.2 1 Preparing the ST#3 pg no test plan 64 to 66 2.3 1 Profiling test ST#3 pg no boundaries 67 2.4 1 Defining business objectives, Project management and scheduling 2.5 1 Public resources and Document gathering 2.6 1 DNS and Route information, Utilizing search engines 2.7 1 All-in-one intelligence gathering 2.8 1 Documenting the information ST#3 pg no 68 to 69 ST#4 pg no 74 to 76 ST#4 pg no 77 to 95 ST#4 pg no 96 to 100 ST#4 pg no 101 to 106 3 Target Discovery and Enumerating 3.1 1 Introduction ST#5 pg no 109 3.2 1 Identifying the target machine ST#5 pg no 110 to 122 3.3 1 OS ST#5 pg no fingerprinting 122 to 125 3.4 1 Port scanning ST#6 pg no 127 to 150 3.5 2 Service ST#6 pg no enumeration 152 to 155 3.6 2 VPN enumeration ST#6 pg no 157 to 158 4 Vulnerability Mapping and Social Engineering Presentation Conceptual reading from textbook Conceptual reading from textbook 21/7/2014 22/7/2014 24/7/2014 25/7/2014 28/7/2014 29/7/2014 31/7/2014 1/8/2014 4/8/2014 5/8/2014 7/8/2014 8/8/2014 11/8/2014 & 12/8/2014 14/8/2014 & 18/8/2014 UNIT TEST - 1 4.1 1 Types of vulnerabilities, Vulnerability taxonomy ST#7 pg no 162 to 165 Conceptual reading from textbook 19/8/2014 4.2 1 Open Vulnerability ST#7 pg no 165 to 169 Prese ntati on 21/8/2014 Page 2
Assessment System (OpenVAS) 4.3 1 Cisco analysis, Fuzzy analysis, SMB analysis, SNMP analysis 4.4 1 Web application analysis, Application assessment tools 4.5 1 Modeling human psychology, Attack process and methods 4.6 1 Social Engineering Toolkit (SET) 4.7 2 Common User Passwords Profiler (CUPP) ST#7 pg no 169 to 188 ST#7 pg no 188 to 216 ST#8 pg no 219 to 224 ST#8 pg no 224 to 234 ST#8 pg no 234 to 235 5 Target Exploitation and Privilege Escalation 5.1 1 Vulnerability research ST#9 pg no 237 to 240 5.2 1 Vulnerability ST#9 pg no and exploit 240 repositories 5.3 1 Advanced exploitation toolkit 5.4 1 Target Exploitation Summary 5.4 1 Attacking the password 5.6 1 Network sniffers 5.7 1 Network spoofing tools 5.8 1 Privilege Escalation Summary 6 Maintaining Access, Documentation and Reporting 6.1 1 Protocol tunneling ST#9 pg no 241 to 273 ST#9 pg no 273 ST#10 pg no 275 to 289 ST#10 pg no 289 to 298 ST#10 pg no 298 to 304 ST#10 pg no 304 ST#11 pg no 305 to 311 Conceptual reading from textbook Presentation Conceptual reading from textbook Conceptual reading 25/8/2014 26/8/2014 28/8/2014 2/9/2014 3/9/2014 & 5/9/2014 4/9/2014 QUIZ - 2 8/9/2014 9/9/2014 11/9/2014 12/9/2014 15/9/2014 16/9/2014 18/9//2014 19/9/2014 22/9/2014 6.2 1 Proxy ST#11 pg 25/9/2014 Page 3
Text Book: Reference Books: no 311 to 313 6.3 1 End-to-end connection ST#11 pg no 313 to 319 6.4 1 Documentation ST#12 pg and results no 321 to verification 323 6.5 1 Types of ST#12 pg reports no 323 to 327 6.6 1 Presentation ST#12 pg no 327 to 328 6.7 2 Post testing procedures ST#12 pg no 328 to 329 1. Tedi Heriyanto, Shakeel Ali. Backtrack 4: Assuring Security By Penetration Testing, Shroff/Packt Publishing 1. Vivek Ramachandran. Backtrack 5 Wireless Penetration Testing Beginner s Guide, Shroff/Packt Publishing 2. Lee Alen. Advanced Penetration Testing for Highly-Secured Environments: The Ultimate Security Guide, Shroff/Packt Publishing 3. Patrick Engebreston. The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy, Syngress. 4. Ronald L. Krutz and Russell Dean Vines. The CEH Prep Guide: The Comprehensive Guide to Certified Ethical Hacking, Wiley 5. Thomas Wilhelm. Professional Penetration Testing: Volume 1: Creating and Learning in a Hacking Lab, Syngress Conceptual Reading Make students read from textbook and then explain. Course Objectives and Course Outcomes Mapping: To understand installation and configuration of BackTrack: CO1, CO2 security testing methodology for planning and implementing penetration testing: CO3, CO4, CO6 29/9/2014 7/10/2014 10/10/201 4 13/10/201 4 14/10/201 4 comparative study of various tools and techniques for security in penetration testing: CO5, CO7, CO8, CO9 Course Units and Course Outcomes Mapping: UNIT TEST - 2 Unit No. Unit Course outcome CO1 CO2 CO3 CO4 CO5 CO6 CO7 CO8 CO9 1 Beginning with Backtrack 2 Target Scoping and Information Gathering 3 Target Discovery and Enumerating 4 Vulnerability Mapping and Social Page 4
Engineering 5 6 Target Exploitation and Privilege Escalation Maintaining Access, Documentation and Reporting Hands-on Experience Activity: Modes of Transaction (Delivery): Students will implement commands of target discovery and vulnerability mapping on BackTrack 4 or BackTrack 5. For Unit 1: (1.3, 1.6, 1.7, 1.8) ;Unit 2: (2.5, 2.6, 2.7, 2.8); Unit 3: (All sub units); For Unit 4: (4.4, 4.5, 4.6, 4.7); Unit 5: (5.3 to 5.8); Unit 6: (All sub units) Students will bring their textbooks, I will make them underline important points and explain them accordingly. For Unit 1 (1.5); Unit 2 (2.1 to 2.4); Unit 4 (4.2, 4.3); Unit 5(5.1, 5.2) Presentation method will be used. For Unit 1 (1.1, 1.2) Demonstration of BackTrack 4 will be given. Activities/Practicum: Assignment Activity: Atleast five questions from each unit will be given. Concept Map: The following activities shall be carried out by the students. Understand the installation process of BackTrack 4 using USB, LIVE DVD & installing it to the hard disk. Viva will be conducted to ensure their understanding The following activities shall be carried out by the teacher. Demonstration of BackTrack 4 installation will be given. Penetration Testing Page 5
Unit-1: Beginning with Backtrack Unit-2: Target Scoping and Information Gathering Page 6
Unit-3: Target Discovery and Enumerating Unit-4: Vulnerability Mapping and Social Engineering Page 7
Unit-5: Target Exploitation and Privilege Escalation Page 8
Unit-6: Maintaining Access, Documentation and Reporting Page 9