Penetration Tests — Flashcards

Physical penetration testing: evaluating the security of physical access controls — doors, windows, elevators, badge systems, server room locks — by attempting to gain unauthorized physical access. Why it matters: physical access completely bypasses software and network controls. An attacker with physical access can: (1) modify the boot process to load malicious code, (2) boot from an external USB/DVD, bypassing the installed OS entirely, (3) modify or replace OS files including authentication binaries. Key principle: no amount of firewall or encryption protects a system from someone who can physically touch it. Servers must live in locked data centers for this reason. Exam point: physical penetration testing is a legitimate security discipline — not just facilities management. It reveals gaps that cyber controls cannot compensate for.

Red team: the offensive group in a penetration testing engagement that simulates real-world attackers. Role: actively searches for vulnerabilities in the organization's defenses and attempts to exploit them, exactly as an attacker would. Activities include: reconnaissance (passive and active), vulnerability identification, exploitation attempts, privilege escalation, lateral movement, and reporting findings. Perspective: the red team thinks like an adversary — it looks for the weakest link, combines small vulnerabilities into attack chains, and targets human factors as well as technical gaps. Exam distinction: red team = offense (attacker simulation); blue team = defense (detection and response). The naming convention is borrowed from military wargaming where red forces attack blue forces. Output: red team findings reveal exploitable vulnerabilities from an attacker's perspective.

Blue team: the defensive security group responsible for detecting attacks, responding to incidents, and preventing unauthorized access. Role: monitors for attacks in real time, uses IDS/IPS and SIEM tools, investigates alerts, patches vulnerabilities found by the red team, and improves detection capabilities. Contrast with red team: red team finds and exploits; blue team detects and defends. Red team's success = a finding for the report; blue team's success = catching the red team in the act or preventing exploitation. Real-world relevance: the blue team is essentially the security operations center (SOC) in operational mode. In penetration testing contexts, blue team activities validate whether defensive controls actually work. Key insight: a red team finding that the blue team detected demonstrates working defenses; one they missed reveals a detection gap.

Integrated penetration testing: a continuous security improvement model where red and blue teams operate simultaneously in an ongoing cycle rather than as a one-time point-in-time assessment. The cycle: (1) Red team finds an exploitable vulnerability, (2) blue team is notified and patches it, (3) red team retests to verify the fix, (4) red team looks for new gaps created by the fix or elsewhere, (5) cycle repeats. Key benefit: converts penetration testing from a periodic event into a continuous security operation. Each iteration strengthens defenses incrementally. Contrast with one-time test: a single engagement produces a point-in-time snapshot; integrated testing provides ongoing coverage as the environment evolves. Exam distinction: this is not the same as a purple team exercise, though it resembles one. The integrated approach is characterized by the feedback loop between attack and remediation.

Known environment test (also called full disclosure or white box): the organization provides complete information to the penetration testers before testing begins. Information provided: network diagrams, IP address inventories, server lists, operating system versions, application architecture documentation. How testers use it: reconnaissance phase is skipped; testers immediately focus on identifying and exploiting vulnerabilities using the provided map. Advantage: maximum depth of testing within limited time budget; testers can thoroughly evaluate all known systems. Disadvantage: least realistic simulation of a real attacker (adversaries do not receive documentation); may miss vulnerabilities the organization didn't know to document. When used: when complete coverage of known systems is more important than simulating a blind external attacker. Contrast: known (white box) → testers know everything; unknown (black box) → testers know nothing.

Unknown environment test (also called blind or black box): testers receive no prior information about the target systems. They must discover everything through reconnaissance before any exploitation can begin. What testers start with: only the target organization name (and authorization documentation). No IP ranges, no system inventories, no network diagrams. Process: complete reconnaissance phase first, then build environmental map, then identify vulnerabilities, then exploit. Advantage: most realistic simulation of a real external attacker; tests the full attack path including detection. Disadvantage: takes significantly longer; may not achieve deep coverage of all systems within time budget. Other names: "black box" test; "blind" test. Exam trap: "blind" refers to the testers being blind to system information, not to the organization. The organization always knows a test is occurring (it authorized it).

Partially known environment test (also called gray box or hybrid): testers receive some information about the target, but not complete disclosure. What is typically provided: IP address ranges but not full network diagrams; high-level architecture overview but not system inventories; user-level credentials but not administrator access. Purpose: simulates an insider threat, a compromised employee account, or a trusted partner with partial access. Balance achieved: more realistic than white box (testers still need to discover details); more focused than black box (testers know where to start). Common use case: testing whether a user with limited access can escalate privileges or access systems beyond their authorization level. Exam distinction: three types in order of tester knowledge: known (white) → partially known (gray) → unknown (black). Gray = some knowledge provided upfront.

Reconnaissance purpose: gather intelligence about the target environment before any exploitation attempts. Three primary goals: (1) Understand security posture — what defenses are in place, what technology is used, what potential weaknesses exist; (2) Minimize attack surface — focus effort on exploitable systems rather than scanning everything blindly; (3) Build a network map — identify which hosts are live, what services they run, what OS they use, and how systems relate to each other. Why it comes first: attacking without reconnaissance wastes time, generates unnecessary noise, and risks missing the most exploitable targets. Skilled attackers invest heavily in reconnaissance before taking any aggressive action. Two types: passive (no target network traffic, very hard to detect) and active (direct interaction with target systems, generates logs). Exam rule: reconnaissance always precedes exploitation in a professional engagement.

Passive reconnaissance: gathering intelligence about the target using publicly available sources without sending any network traffic to the target's systems. Techniques: (1) Social media — LinkedIn for employee names/roles/technologies; (2) Corporate websites — organizational structure, technology stack clues, email formats; (3) Forums and discussion boards — Reddit, Stack Overflow threads where employees discuss technical problems; (4) OSINT tools — Shodan, WHOIS, public DNS records; (5) Job postings — reveal technology stack (a posting for "AWS Lambda developer" reveals cloud infrastructure); (6) Dumpster diving — physical technique; discarded documents, hardware, sticky notes; (7) Business organizations — industry associations, conference speaker lists. Key property: generates no traffic to the target network; very difficult for the target to detect. Exam: "no direct interaction with target systems" = passive.

Active reconnaissance: gathering intelligence by directly sending network traffic to the target's systems. Techniques: (1) Ping scan — ICMP requests to identify live hosts (which IPs respond?); (2) Port scan — TCP/UDP probes to identify open ports on live hosts; (3) OS fingerprinting — analyze how a system responds to crafted packets to identify its operating system and version; (4) Service/version scan — connect to open ports to identify the running application and version number (enables CVE matching); (5) DNS queries — active DNS enumeration to discover subdomains and internal naming. Key property: generates network traffic that appears in firewall logs, IDS/IPS alerts, and server access logs. The target can detect this. Exam rule: "sends traffic to target systems" or "appears in logs" = active reconnaissance. Active provides more precise technical data than passive.

OS fingerprinting: a technique that analyzes how a target system responds to specifically crafted network packets to identify its operating system, version, and sometimes patch level. How it works: different OS implementations handle edge cases in TCP/IP slightly differently (TTL values, window sizes, response to malformed packets). Tools like Nmap analyze these response characteristics to match against known OS signatures. Why it matters: knowing the OS enables targeted vulnerability research. A system running Windows Server 2012 R2 unpatched vs. Windows Server 2022 requires completely different attack approaches. CVE mapping: once OS and service versions are known, testers search CVE databases for known vulnerabilities applicable to those specific versions. Passive equivalent: banner grabbing (reading the version string a service announces itself with) is less reliable; active fingerprinting is more accurate. Exam context: OS fingerprinting = active reconnaissance technique.

Dumpster diving: physically searching through an organization's discarded materials to recover information useful for an attack. What can be found: printed documents with usernames, IP addresses, or network diagrams; discarded hardware (old hard drives, USB drives, phones) that may contain residual data; sticky notes with passwords; organization charts; vendor invoices revealing technology partners. Why it works: many organizations have poor information disposal practices. Shredding policies exist but may not be enforced; hardware may be discarded without wiping. Classification: passive reconnaissance — dumpster diving does not interact with the target's network. However, it is physical in nature and requires on-site presence. Countermeasures: cross-cut shredding policy, secure disposal of hardware, locked dumpsters, employee training. Exam point: dumpster diving is explicitly listed as a passive reconnaissance technique; physical presence does not make it active.

Passive reconnaissance: no direct interaction with target systems; uses public sources only; does not appear in target logs; very difficult to detect; examples: LinkedIn, corporate website, OSINT tools, dumpster diving, forums, job postings. Active reconnaissance: directly sends traffic to target systems; appears in firewall logs and IDS alerts; can be detected; examples: ping scan, port scan, OS fingerprinting, service/version scan, DNS enumeration. Detection comparison: passive = nearly undetectable (gathering already-public information); active = detectable (the target's systems receive and log the probes). Data quality comparison: passive = high-level organizational/human intelligence; active = precise technical details (open ports, OS versions, service versions). Timing comparison: passive first (safe, no exposure); active later (necessary but risky). Exam shortcut: "no traffic to target" = passive; "traffic/probes/logs" = active. Physical presence (dumpster diving) = still passive.

Three team types: Red team: offensive; simulates attackers; finds and exploits vulnerabilities; thinks adversarially; reports findings. Blue team: defensive; detects attacks; responds to incidents; patches findings; improves monitoring. Purple team (implied by integration): occurs when red and blue teams formally share information and collaborate simultaneously rather than operating independently. Integrated model: red team finds a gap → blue team patches it → red team retests → cycle continues. This is the continuous improvement model. Key distinction: a standard engagement has red and blue working in opposition (red attacks, blue defends without knowing what red is doing). A purple team/integrated approach involves explicit information sharing and collaboration. Exam trap: the source material describes the integrated approach as the feedback loop between red and blue, not necessarily requiring formal purple team labeling. Know the concept over the label.