Exploring the phases of penetration testing

Ethical hackers and penetration testers are white hat hackers, and it’s important to understand the general phases of hacking and how each phase is typically aligned to penetration testing. During any penetration testing training, you’ll encounter the five phases of hacking.

The following are the general five phases of hacking:

Figure 1.2: Phases of penetration testing

As shown in the preceding diagram, a threat actor performs reconnaissance on the targeted system, network, or organization to collect as much information as possible to better understand the attack surface of the target before moving forward and launching an attack to compromise the target. In the following subsections, you will learn more about the purpose of each phase and how it aligns with ethical hacking and penetration testing.

Reconnaissance

Reconnaissance, commonly referred to as the information-gathering phase, is where the threat actor focuses on acquiring meaningful information about their target. The collected information is analyzed to create context and develop a profile about the targeted system, network, or organization. The collected information helps the threat actor better understand the target’s attack surface and develop/acquire specific exploits that are suitable for compromising targeted systems.

The following are techniques used in the reconnaissance phase:

• Using internet search engines to gather information
• Using social networking platforms
• Performing Google hacking techniques
• Performing Domain Name System (DNS) interrogation
• Using social engineering techniques

During this phase, the objective is to gather as much information as possible about the target. Next, we will discuss using a more direct approach: engaging the target to get specific and detailed information.

Scanning and enumeration

The second phase of hacking is scanning. Scanning involves using a direct approach via active reconnaissance in engaging the target to obtain information that is not accessible via passive information-gathering techniques. This phase also involves profiling the targeted organization, its systems, and network infrastructure by sending specially crafted probes to the target.

The following are techniques used in the scanning phase:

• Performing host discovery
• Checking for firewalls and testing their rules
• Checking for open network ports and running services
• Checking for security vulnerabilities
• Creating a network topology of the target network

This phase is very important as it helps us improve the profile of the target. The information found in this phase will help us move on to performing exploitation on the targeted system or network.

Gaining access (exploitation)

This phase can sometimes be the most challenging phase of all. During this phase, the threat actor uses information obtained from the previous phases to either craft an exploit or acquire one from online sources that is designed to compromise the security vulnerability of the target. In addition, the threat actor needs to test the exploit to ensure it’s working as expected before delivering and executing it on the targeted system.

The following can occur once access is gained on a targeted system or network:

• Retrieving and cracking stored passwords on systems
• Escalating privileges
• Transferring additional payloads and malware

The gaining access (exploitation) phase can at times be difficult as exploits may work on one targeted system and not on another. Once an exploit is successful and system access is acquired, the next phase is to ensure the threat actor expands their foothold on the compromised system and network.

Maintaining access

After gaining access to a system, the threat actor usually attempts to implement additional backdoors on the compromised system to expand their foothold. In addition, the threat actor usually performs lateral movement on the network by compromising other systems and setting up backdoors for persistent access to the victim’s network. Therefore, if a compromised system is offline, the attacker can attempt to remotely connect to another to regain access to the targeted network.

The objectives of maintaining access are as follows:

• Lateral movement
• Exfiltration of data
• Creating backdoor and persistent connections

Maintaining access is important to ensure that you, the penetration tester, always have access to the targeted systems or network. Once the technical aspect of the penetration test is completed, it’s time to clean up the network.

Covering your tracks

The last phase is to cover your tracks. This ensures that you do not leave any traces of your presence on a compromised system or network. As penetration testers, we would like to be as undetectable as possible on a targeted network, not triggering any alerts on security sensors and appliances while we remove any residual traces of the actions performed during the penetration test. Covering your tracks ensures that you don’t leave any trace of your presence on the network, as a penetration test is designed to be stealthy and simulate real-world attacks on an organization to both identify hidden security vulnerabilities and test the effectiveness of the cyber defenses of the organization.

Having completed this section, you have gained the knowledge to describe the various phases of hacking that are commonly used by threat actors. In the next section, you will discover the Cyber Kill Chain framework, which we are going to leverage in the training and exercises throughout this book.